CVE-2026-34225: 
Python vulnerability analysis and mitigation

CVE-2026-34225 is a Blind Server-Side Request Forgery (SSRF) vulnerability in Open WebUI, a self-hosted AI platform, affecting versions 0.7.2 and below. The flaw resides in the image editing via prompt functionality, where the application performs an unrestricted GET request to any user-supplied URL, including local/internal addresses. It was published on April 14, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory). The issue was noted as unresolved at the time of initial publication, though a patch advisory has since been issued (GitHub Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), stemming from insufficient input validation in the image_edits function within backend/open_webui/routers/images.py. Specifically, the load_url_image helper function (lines 850–916) blindly trusts any URL beginning with http:// or https:// and issues a requests.get() call without restricting the destination domain or IP range, allowing access to the local address space (GitHub Advisory). Exploitation requires a low-privilege authenticated account and is performed over the network with low attack complexity. A concrete PoC curl command targeting the /api/v1/images/edit endpoint with a user-controlled image URL parameter has been publicly disclosed (GitHub Advisory).

Because the SSRF is blind — the HTTP response body is not returned to the attacker — the primary confirmed impact is internal network port scanning: an attacker can distinguish open from closed ports based on whether the server-side GET request succeeds or fails, enabling full enumeration of the local port range (GitHub Advisory). Secondary impact includes potential interaction with internal services that expose state-changing GET endpoints (e.g., unauthenticated admin APIs, metadata services), which could lead to unauthorized actions on internal infrastructure (GitHub Advisory). Confidentiality is assessed as low (internal topology disclosure); integrity and availability impacts are assessed as none under the current CVSS scoring.

A public proof-of-concept exploit in the form of a documented curl command is available in the GitHub Security Advisory, with high confidence that it is a real, reproducible exploit (GitHub Advisory). Exploitation requires a low-privilege authenticated session but no special configuration. The EPSS score is approximately 0.025% (0.000250), indicating a currently low probability of widespread exploitation. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Authenticate: Obtain a valid low-privilege user account on the target Open WebUI instance (version ≤ 0.7.2) and retrieve a Bearer token via the login API.
2. Identify target internal host/port: Select an internal IP address and port to probe (e.g., http://127.0.0.1:6379 for Redis, http://169.254.169.254/ for cloud metadata, or any RFC-1918 address).
3. Send crafted POST request: Issue a POST request to /api/v1/images/edit with the image field set to the internal URL:

curl -X POST http://<target>:3000/api/v1/images/edit \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"form_data":{"image": "http://127.0.0.1:<port>", "prompt": "poc"}}'

4. Analyze response differential: A successful HTTP 200 response (or specific error) indicates the port is open; an HTTP 400 or connection-refused error indicates it is closed. Use this differential to confirm port status.
5. Automate port scan: Script the above request across all 65,535 ports (or a targeted range) to enumerate open services on the internal network.
6. Interact with discovered services: If an open port hosts a service with state-changing GET endpoints (e.g., an unauthenticated admin panel), craft further requests via the same SSRF vector to trigger those actions (GitHub Advisory).

• Network: Unusual outbound GET requests from the Open WebUI server process to internal RFC-1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.1); repeated rapid connections to sequential port numbers on internal hosts suggesting automated port scanning.
• Logs: High volume of HTTP 400 errors or connection-refused responses logged by the Open WebUI application associated with the /api/v1/images/edit endpoint; access logs showing the image parameter containing http:// URLs pointing to internal/private IP addresses rather than external image hosts.
• Application Behavior: Repeated POST requests to /api/v1/images/edit from a single authenticated user with varying internal IP/port combinations in the image field; requests where the image URL does not resolve to a valid image resource (GitHub Advisory).

The recommended remediation is to upgrade Open WebUI to a version later than 0.7.2, which addresses the unrestricted URL fetching in the image edit functionality (GitHub Advisory). As interim workarounds, implement network segmentation to restrict the Open WebUI server's outbound access to internal IP ranges, and deploy a Web Application Firewall (WAF) or egress filter to block requests to private address spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8). Additionally, enforce server-side URL allowlisting to permit only known external image provider domains in the image parameter.

The vulnerability was reported by security researcher gg0h and published via GitHub's security advisory program on April 12, 2026 (GitHub Advisory). Coverage appeared across CVE aggregation platforms and a dedicated write-up was published at infinitsec.net shortly after disclosure. No significant vendor statements beyond the advisory or notable social media debate have been identified.