Open WebUI has SSRF in /openai/models

The SSRF vulnerability in open-webui allows an attacker to control the URL used by the /openai/models endpoint. By manipulating this URL, an attacker can force the application to make requests to arbitrary internal or external resources. This could expose sensitive data stored within the internal network, such as database credentials or API keys. More critically, an attacker could potentially access instance secrets, leading to command execution on the server hosting open-webui. This represents a significant escalation of risk, potentially allowing for complete system compromise. The ability to redirect requests to internal services without proper validation makes this a particularly dangerous vulnerability.

Organizations deploying open-webui, particularly those using it to interact with OpenAI services, are at risk. Environments with weak network segmentation or exposed internal services are especially vulnerable. Users relying on open-webui for sensitive tasks or data processing should prioritize mitigation.

• python / server:

import requests
import urllib3

http = urllib3.PoolManager()

try:
    response = http.request('GET', 'http://localhost:7860/openai/models?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/admin')
    print(response.status)
except Exception as e:
    print(f"Error: {e}")

• linux / server:

journalctl -u open-webui -g "openai/models"

• generic web:

curl -I http://<open-webui-ip>/openai/models?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/admin

1. 2025-03-20Disclosure

   disclosure

1. Reserviert2024-08-19
2. Veröffentlicht2025-03-20
3. Geändert2025-03-21
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-7959 is to upgrade open-webui to a version that addresses the SSRF vulnerability. Unfortunately, a fixed version is not explicitly mentioned in the provided data. As a temporary workaround, implement a Web Application Firewall (WAF) rule to restrict outbound requests from the /openai/models endpoint to only trusted OpenAI domains. Additionally, carefully review and restrict access to any internal services that might be exposed by this vulnerability. Consider implementing stricter network segmentation to limit the blast radius of a potential compromise. After upgrading (or implementing WAF rules), verify the mitigation by attempting to access an internal resource through the /openai/models endpoint; the request should be blocked or redirected to the intended OpenAI domain.