Summary
Open WebUI: WEBFETCHFILTER_LIST host allow/block filter bypassable via URL path and non-label-boundary matching
The administrator-configured WEB_FETCH_FILTER_LIST (the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch) matches hostnames incorrectly, so the filter can be bypassed.
Details
is_string_allowed (backend/open_webui/utils/misc.py) matches with str.endswith(...), and the primary web-fetch call site (backend/open_webui/retrieval/web/utils.py) called it with the full URL string, not the hostname:
- Blocklist bypass via path. A blocklist entry
!internal.example.comonly matches a URL that ends with that string. Any URL with a path (https://internal.example.com/x) ends with/x, so the entry never matches and the fetch proceeds. The blocklist effectively only stopped path-less URLs. - Allowlist false-reject and bypass. An allowlist
company.comrejected the legitimatehttps://api.company.com/statusand admittedhttps://attacker.example/path/company.com. - Non-label-boundary matching at the hostname-shaped call site (
retrieval/web/main.py):endswith('corp.com')also matchedevilcorp.com, and10.0.0.1matched110.0.0.1.
Credit
Reported by @addcontent.
Impact
An authenticated user able to trigger a server-side web fetch can reach hosts the administrator intended to block with WEB_FETCH_FILTER_LIST.
Open WebUI's primary SSRF protection is a separate, always-on guard that rejects any URL resolving to a non-global IP (validate_url and the connection-layer _ssrf_safe_new_conn, active whenever ENABLE_RAG_LOCAL_WEB_FETCH is off, the default). That guard is unaffected by this issue and continues to block loopback, RFC1918 and link-local addresses, including the 169.254.169.254 cloud-metadata endpoint. This bypass therefore does not grant access to those internal targets. What it defeats is the administrator's ability to block specific publicly-resolvable hosts (internal services reachable from the server over a public IP, e.g. split-horizon DNS or internal PaaS endpoints) and to enforce an allowlist. Fetched content is returned to the requester, so for hosts reachable from the server's network position this is a read/content-disclosure SSRF against the admin-blocked host.
CVE-2026-59223 has a CVSS score of 4.3 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.10.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Matching is now performed on the parsed hostname using DNS label boundaries. A dedicated is_host_allowed(host, ...) matches an entry only when host and entry are equal or the entry is a parent domain (host == entry or host.endswith('.' + entry)), so corp.com matches api.corp.com but not evilcorp.com, and IP entries match only the identical address. Both web-fetch call sites pass the parsed hostname rather than the full URL. The generic is_string_allowed is retained unchanged for unrelated non-host filters.
Frequently Asked Questions
- What is CVE-2026-59223? CVE-2026-59223 is a medium-severity security vulnerability in open-webui (pip), affecting versions < 0.10.0. It is fixed in 0.10.0.
- How severe is CVE-2026-59223? CVE-2026-59223 has a CVSS score of 4.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of open-webui are affected by CVE-2026-59223? open-webui (pip) versions < 0.10.0 is affected.
- Is there a fix for CVE-2026-59223? Yes. CVE-2026-59223 is fixed in 0.10.0. Upgrade to this version or later.
- Is CVE-2026-59223 exploitable, and should I be worried? Whether CVE-2026-59223 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-59223 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-59223? Upgrade
open-webuito 0.10.0 or later.