CVE WatchOct 18, 2026

CVE-2025-65958

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Fo

CVSS

8.5

High

EPSS

4.7%

p92

KEV

—

Exploit Today

0-100

Published: Dec 4, 2025 · Last modified: Oct 18, 2026 · CWE-918

EPSS · 30d

4.4%EPSS · 30 days4.7%

2026-10-172026-11-13

Technical description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-821026.4 MED

—

——0IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.1d CVE-2026-1101945.4 MED

—

——0IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.1d CVE-2026-1272176.4 MED

—

——0Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbp_post_attachment URL that reaches a raw getimagesize() call in validate_external_image_size() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server.1d CVE-2026-1272148.5 HIG

—

——0Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.2d CVE-2026-1290944.7 MED

—

——0@utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a {host} placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE discovery to access internal services on the agent machine.2d CVE-2026-821753.8 LOW

—

——0Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance.2d