---
id: CVE-2026-54020
title: >-
  Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI
  platform
summary: >-
  Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI
  platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL
  validation and rejected private, loopback, and link-local addresses, but the
  HTTP clients re…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-367
  - CWE-918
vendor: openwebui
product: open_webui
affected:
  - open_webui < 0.11.0
patched:
  - open_webui 0.11.0
published: '2026-08-04'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T14:58:07.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54020'
references:
  - url: 'https://github.com/open-webui/open-webui/releases/tag/v0.11.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-webui/open-webui/security/advisories/GHSA-h6x2-583h-x99r
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-h6x2-583h-x99r'
tags:
  - nvd
  - ghsa
  - pip
epss: 0.00213
epssPercentile: 0.11957
aliases:
  - GHSA-h6x2-583h-x99r
ecosystem: pip
ingestedAt: '2026-08-04T20:41:43.710Z'
---

## Overview

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticated attacker who controlled authoritative DNS for a submitted hostname could answer with a public address during validation and an internal one during connection, reaching cloud metadata, loopback admin APIs, or internal services through URL ingest, chat image_url fetches, image editing, or OAuth profile-picture fetches, with most paths returning the response to the attacker and the OAuth path forwarding the OAuth access token. This issue is fixed in 0.11.0.

## Affected

- `open_webui < 0.11.0`

## Remediation

Upgrade past the affected range:

- `open_webui 0.11.0`

## Package advisory (CVE-2026-54020)

Affected packages:

- `open-webui <= 0.10.2`

Patched in:

- `open-webui 0.11.0`

Source: https://github.com/advisories/GHSA-h6x2-583h-x99r