Log in Start free

Vulnerability · Published Aug 4, 2026 · Assigned by GitHub_M

CVE-2026-70480Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Medium 4.1

In plain English

A medium-severity server-side request forgery in open-webui from open-webui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user browser issue attacker-chosen outbound GET requests and read responses from same-origin or CORS-permissive targets into the rendered page. This issue is fixed in 0.11.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIopen-webui0.11.0GHSA-rffm-9q57-q649
PyPIopen-webui0.11.0PYSEC-2026-3651

Affected products (as reported)

VendorProductVersions
open-webui open-webui >= 0.6.34, < 0.11.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

References