CVE-2025-65958
📋 TL;DR
Open WebUI versions before 0.6.37 contain a Server-Side Request Forgery (SSRF) vulnerability that allows any authenticated user to make the server send HTTP requests to arbitrary internal or external URLs. This can lead to unauthorized access to cloud metadata, internal network services, and sensitive data exfiltration. All Open WebUI instances running vulnerable versions with authenticated users are affected.
💻 Affected Systems
- Open WebUI
📦 What is this software?
Open Webui by Openwebui
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of cloud infrastructure via metadata endpoints, lateral movement through internal networks, data exfiltration from internal services, and potential credential theft leading to full environment takeover.
Likely Case
Unauthorized access to internal services, cloud metadata harvesting, network reconnaissance, and potential data leakage from systems accessible to the Open WebUI server.
If Mitigated
Limited impact if network segmentation restricts server access, but still potential for information disclosure from accessible services.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited; authenticated access required but no special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.37
Vendor Advisory: https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685
Restart Required: Yes
Instructions:
1. Backup your Open WebUI configuration and data. 2. Update Open WebUI to version 0.6.37 or later using your deployment method (Docker, manual install, etc.). 3. Restart the Open WebUI service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allRestrict Open WebUI server's network access to only required services using firewall rules.
Authentication Hardening
allImplement strong authentication controls and limit user access to only trusted individuals.
🧯 If You Can't Patch
- Implement strict network egress filtering to block all outbound HTTP/HTTPS traffic from the Open WebUI server except to required services.
- Deploy a web application firewall (WAF) with SSRF protection rules and monitor for suspicious outbound requests.
🔍 How to Verify
Check if Vulnerable:
Check your Open WebUI version; if it's below 0.6.37, you are vulnerable.Check Version:
Check the Open WebUI web interface settings or run: docker inspect open-webui | grep VERSIONVerify Fix Applied:
Confirm Open WebUI version is 0.6.37 or higher and test that SSRF attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Open WebUI server
- Requests to internal IP addresses or cloud metadata endpoints
- Multiple failed connection attempts to various internal services
Network Indicators:
- HTTP traffic from Open WebUI server to unexpected destinations
- Requests to 169.254.169.254 (AWS metadata) or similar cloud endpoints
- Port scanning patterns originating from Open WebUI server
SIEM Query:
source="open-webui" AND (dest_ip=169.254.169.254 OR dest_ip=metadata.google.internal OR dest_ip IN [RFC1918 ranges])