CVE-2024-7959
High · 7.7Open WebUI has SSRF in /openai/models
CVSS
7.7
EPSS
24.5%
Published
Mar 20, 2025
CISA due date
—
The record
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF). An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the attacker to access internal services and potentially gain command execution by accessing instance secrets.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | open-webui | 0 | No fix |
Related vulnerabilities
- CVE-2026-44721 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- GHSA-gf5m-wcrh-7928 open-webui Vulnerable to Stored XSS via Model Description Also affects open-webui
- GHSA-c6xv-rcvw-v685 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing… Also affects open-webui
- CVE-2025-65958 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing… Also affects open-webui
- GHSA-frv8-gffc-37px open-webui is Vulnerable to Incorrect Access Control Also affects open-webui
- CVE-2025-63681 open-webui is Vulnerable to Incorrect Access Control Also affects open-webui
- GHSA-cm35-v4vp-5xvx Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via… Also affects open-webui
- GHSA-w7xj-8fx7-wfch Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is… Also affects open-webui