{"id":"CVE-2024-7959","aliases":["GHSA-x757-hv69-jr45","PYSEC-2026-1743"],"title":"Open WebUI has SSRF in /openai/models","summary":"Open WebUI has SSRF in /openai/models","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","vendor":"open-webui","product":"open-webui","ecosystem":"pip","affected":["open-webui <= 0.3.8"],"published":"2025-03-20","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-x757-hv69-jr45","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7959"},{"url":"https://github.com/open-webui/open-webui"},{"url":"https://huntr.com/bounties/3c8bea0a-d678-4d67-bb9c-2b5b610a2193"}],"tags":["osv","pip"],"epss":0.24461,"epssPercentile":0.97628,"ingestedAt":"2026-07-08T18:25:54.129Z","slug":"CVE-2024-7959","body":"## Overview\n\nThe `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF). An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the attacker to access internal services and potentially gain command execution by accessing instance secrets.\n\n## Affected packages\n\n- `open-webui <= 0.3.8`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":42.4,"likelihood":4.9,"exploitation":0,"ransomware":0},"changes":[]}