CVE-2026-54018

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6

Description The SafePlaywrightURLLoader uses a validate url() function to prevent Server-Side Request Forgery (SSRF) by checking the IP address of a user-provided URL. However, this validation only occurs for the initial URL. Because Playwright follows HTTP redirects (301/302) by default, an attacker can provide a safe URL that redirects to a restricted internal network address, such as localhost, Docker container networks, or Cloud Metadata services. This allows unauthorized access to internal services even when ENABLE RAG LOCAL WEB FETCH is set to False. The issue occurs because the application calls page.goto(url) without re-validating the destination of the redirect chain.

Recommendations Update to version 0.9.6.