Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.
References
| Link | Resource |
|---|---|
| https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774 | Patch |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685 | Exploit Vendor Advisory |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685 | Exploit Vendor Advisory |
Configurations
History
10 Dec 2025, 15:18
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Openwebui open Webui
Openwebui |
|
| References | () https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774 - Patch | |
| References | () https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685 - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
08 Dec 2025, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685 - |
04 Dec 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-04 20:16
Updated : 2025-12-10 15:18
NVD link : CVE-2025-65958
Mitre link : CVE-2025-65958
CVE.ORG link : CVE-2025-65958
JSON object : View
Products Affected
openwebui
- open_webui
CWE
CWE-918
Server-Side Request Forgery (SSRF)