{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/ge-vernova/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.5,"id":"CVE-2025-65958"},{"id":"CVE-2026-45331"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["open-webui (\u003c= 0.8.12)"],"_cs_severities":["high"],"_cs_tags":["ssrf","open-webui","vulnerability"],"_cs_type":"advisory","_cs_vendors":["GE Vernova"],"content_html":"\u003cp\u003eOpen WebUI versions 0.8.12 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability in the \u003ccode\u003evalidate_url()\u003c/code\u003e function located in \u003ccode\u003ebackend/open_webui/retrieval/web/utils.py\u003c/code\u003e. This flaw stems from the \u003ccode\u003evalidators\u003c/code\u003e library not properly implementing the \u003ccode\u003eprivate\u003c/code\u003e keyword for IPv6 address validation, causing it to silently fail and allow all IPv6 addresses. Furthermore, IPv4-mapped IPv6 addresses (e.g., \u003ccode\u003e::ffff:10.0.0.1\u003c/code\u003e) bypass the IPv4 validation checks entirely. Several reserved IPv4 ranges, such as \u003ccode\u003e0.0.0.0/8\u003c/code\u003e and \u003ccode\u003e100.64.0.0/10\u003c/code\u003e, are also not blocked. This vulnerability affects multiple endpoints that rely on \u003ccode\u003evalidate_url()\u003c/code\u003e, including \u003ccode\u003e/api/v1/retrieval/process/web\u003c/code\u003e and \u003ccode\u003e/api/v1/images/edit\u003c/code\u003e. Despite a previous patch attempt (GHSA-c6xv-rcvw-v685 / CVE-2025-65958), the issue was not fully resolved, leaving systems vulnerable to internal resource access and potential data exfiltration. Dor Konis of GE Vernova identified the IPv6 bypass, and wlayzz identified the unblocked IPv4 ranges.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated user logs into the Open WebUI application.\u003c/li\u003e\n\u003cli\u003eThe user crafts a malicious request to an endpoint that utilizes the \u003ccode\u003evalidate_url()\u003c/code\u003e function, such as \u003ccode\u003e/api/v1/retrieval/process/web\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe request includes a URL containing either a direct IPv6 address or an IPv4-mapped IPv6 address (e.g., \u003ccode\u003ehttp://[::ffff:169.254.169.254]/\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003evalidate_url()\u003c/code\u003e function in \u003ccode\u003ebackend/open_webui/retrieval/web/utils.py\u003c/code\u003e attempts to validate the URL's IP address.\u003c/li\u003e\n\u003cli\u003eDue to the flawed validation logic, the IPv6 or IPv4-mapped IPv6 address bypasses the intended restrictions.\u003c/li\u003e\n\u003cli\u003eThe server-side process makes an HTTP request to the attacker-specified internal IP address.\u003c/li\u003e\n\u003cli\u003eIf the target is a cloud metadata service (e.g., AWS IMDSv1 at \u003ccode\u003e169.254.169.254\u003c/code\u003e), the server retrieves sensitive information, such as IAM credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates the obtained IAM credentials for unauthorized access to cloud resources.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows any authenticated user to perform Server-Side Request Forgery (SSRF) attacks, accessing internal IPv4 and IPv6 addresses from the Open WebUI server process. This includes access to cloud metadata services, localhost-bound APIs, and other internal services. The reachability of IMDSv1 leads to the exfiltration of IAM credentials, enabling attackers to gain unauthorized access to cloud resources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the recommended fix by replacing the \u003ccode\u003evalidators\u003c/code\u003e library calls in the \u003ccode\u003evalidate_url()\u003c/code\u003e function with the \u003ccode\u003eipaddress\u003c/code\u003e module from Python's standard library as described in the advisory. This will ensure proper validation of IPv4 and IPv6 addresses, including private, loopback, link-local, multicast, reserved, and unspecified addresses.\u003c/li\u003e\n\u003cli\u003eImplement explicit blocks for IANA reserved IPv4 ranges (0.0.0.0/8, 100.64.0.0/10, 192.0.0.0/24, etc.) within the \u003ccode\u003evalidate_url()\u003c/code\u003e function to prevent bypasses.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Open WebUI SSRF Attempt via IPv4-mapped IPv6\u003c/code\u003e to identify exploitation attempts targeting internal resources via IPv4-mapped IPv6 addresses.\u003c/li\u003e\n\u003cli\u003eUpgrade to a patched version of Open WebUI that incorporates the recommended fixes to address CVE-2026-45331 and prevent future SSRF attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-14T20:20:02Z","date_published":"2026-05-14T20:20:02Z","id":"https://feed.craftedsignal.io/briefs/2026-05-open-webui-ssrf-7927cfeb/","summary":"Open WebUI is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation in the `validate_url()` function, allowing authenticated users to access internal IPv4 and IPv6 addresses, potentially leading to IAM credential exfiltration.","title":"Open WebUI SSRF Vulnerability via IPv6/IPv4-mapped IPv6 Bypass","url":"https://feed.craftedsignal.io/briefs/2026-05-open-webui-ssrf-7927cfeb/"}],"language":"en","title":"CraftedSignal Threat Feed - GE Vernova","version":"https://jsonfeed.org/version/1.1"}