Server-Side Request Forgery

Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.

1. Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/webCVE-2025-65958open-webui · CVSS 8.5 · 4.7% likely

   CWE-918

2. Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loaderCVE-2026-70479open-webui · CVSS 7.7 · 0.5% likely

   CWE-918

3. Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/webCVE-2026-56399open-webui · CVSS 5 · 0.5% likely

   CWE-918

4. Open WebUI vulnerable to server-side request forgery in utils.pyCVE-2024-30256open-webui · CVSS 6.4 · 0.4% likely

   CWE-918

5. Open WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)CVE-2026-45338open-webui · CVSS 7.7 · 0.4% likely

   CWE-918

6. Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP RedirectsCVE-2026-54018open-webui · CVSS 7.7 · 0.4% likely

   CWE-918

7. Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targetsCVE-2026-88001open-webui · CVSS 5 · 0.4% likely

   CWE-918

8. Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetchCVE-2026-87999open-webui · CVSS 7.1 · 0.4% likely

   CWE-918

9. Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLsCVE-2026-70485open-webui · CVSS 7.1 · 0.4% likely

   CWE-918

10. Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart renderingCVE-2026-70480open-webui · CVSS 4.1 · 0.3% likely

    CWE-918

11. Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`CVE-2026-54008open-webui · CVSS 8.5 · 0.3% likely

    CWE-918

12. Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load EndpointsCVE-2026-45401open-webui · CVSS 8.5 · 0.3% likely

    CWE-918

13. Open WebUI has Blind Server Side Request Forgery in its Image Edit FunctionalityCVE-2026-34225open-webui · CVSS 4.3 · 0.3% likely

    CWE-918

14. Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url`CVE-2026-45400open-webui · CVSS 8.5 · 0.3% likely

    CWE-918

15. Open WebUI: Full SSRF Vulnerability in the RAG Web Search FeatureCVE-2026-45331open-webui · CVSS 8.5 · 0.3% likely

    CWE-918

16. Open WebUI: Blind server side request forgery (SSRF) via the PDF generate functionCVE-2026-45347open-webui · CVSS 4.3 · 0.2% likely

    CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.