CVE-2026-54020

Executive Summary

CVE-2026-54020 is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in Open WebUI, a self-hosted AI platform, affecting all versions prior to 0.11.0. An authenticated attacker who controls authoritative DNS for a submitted hostname can exploit a hostname resolution race condition to access cloud metadata endpoints, loopback admin APIs, or internal services that should be unreachable from the public internet. The vulnerability carries a CVSS score of 6.3 (Medium severity) due to high attack complexity and the requirement for authentication, but it has a significant confidentiality impact with a changed security scope, potentially allowing exfiltration of sensitive data including OAuth access tokens.

Technical Analysis

The root cause of CVE-2026-54020 lies in an inconsistent hostname resolution pattern within Open WebUI's URL validation mechanism. The application implements a two-phase resolution process:

1. Validation Phase: When a user submits a URL for ingestion (through chat image_url fetches, image editing, URL ingest, or OAuth profile-picture fetching), Open WebUI resolves the hostname to an IP address and validates that the resolved address is not a private, loopback, or link-local address. This is a security control designed to prevent Server-Side Request Forgery (SSRF) attacks.

2. Connection Phase: The HTTP client — likely the underlying HTTP library (e.g., Python requests, httpx, or aiohttp) — performs a second DNS resolution at connection time to obtain the actual IP address to connect to.

The vulnerability is that these two resolutions are independent. An attacker who controls authoritative DNS for a domain can return a legitimate public IP address during the validation phase, then return an internal IP address (e.g., 169.254.169.254 for cloud metadata, 127.0.0.1, or a private subnet address) during the connection phase. This is a classic TOCTOU (Time-of-Check to Time-of-Use) race condition, classified under CWE-367.

The affected attack surface includes:

• URL ingest: Features that allow users to submit URLs for processing by the AI model
• Chat image_url fetches: When a chat message includes an image URL that the platform retrieves
• Image editing: Features that fetch remote images for modification
• OAuth profile-picture fetches: When a user connects an OAuth provider and the platform fetches the profile picture from a URL

For most paths, the response body is returned to the attacker, enabling data exfiltration. Critically, the OAuth path is more dangerous: it forwards the OAuth access token from the callback to the attacker-controlled URL, potentially granting persistent access to the victim's OAuth-authorized services.

The vulnerability requires an authenticated attacker, meaning they must have a valid account on the Open WebUI instance. This reduces the attack surface but still leaves multi-tenant deployments, shared instances, and any installation where users can register accounts at risk.

Exploitation Scenarios

Scenario 1: Cloud Metadata Exfiltration via DNS Rebinding

1. Reconnaissance: The attacker identifies a publicly accessible Open WebUI instance (e.g., via Shodan search for default port 8080 or 3000). They register an account and authenticate.
2. Infrastructure Setup: The attacker registers a domain (e.g., evil.attacker.com) and sets up a DNS server they control. The DNS server is configured to return a public IP (e.g., the attacker's own server or a legitimate external IP) by default, but is programmed to return 169.254.169.254 (AWS/GCP metadata endpoint) or 127.0.0.1 for specific DNS queries triggered by the target's connection phase.
3. Trigger: The attacker submits a crafted URL using the URL ingest feature (or image URL fetching), pointing to http://evil.attacker.com/latest/meta-data/ (a standard cloud metadata path).
4. Race Condition Exploitation: Open WebUI resolves evil.attacker.com → gets the public IP (validation passes). The HTTP client then resolves again → gets 169.254.169.254 and connects to the metadata service on the Open WebUI host's cloud environment.
5. Exfiltration: The metadata response (containing IAM temporary credentials in AWS, or service account tokens in GCP) is returned to the attacker through the application response.
6. Post-exploitation: The attacker uses the stolen cloud credentials to access S3 buckets, read secrets, or pivot within the cloud account.

Scenario 2: OAuth Token Theft via Loopback

1. Target Selection: The attacker targets an Open WebUI instance configured with OAuth (e.g., Google, GitHub, or a corporate IdP).
2. Malicious URL Setup: The attacker's DNS server is programmed to return 127.0.0.1 when queried by the Open WebUI host.
3. Trigger via OAuth: The attacker initiates an OAuth login flow (or convinces a victim to) that includes a profile-picture URL pointing to http://evil.attacker.com/picture.
4. Race Condition: The validation resolves to the public IP, but the connection resolves to 127.0.0.1, allowing the client to connect to the local admin API on the Open WebUI server.
5. Token Forwarding: The OAuth access token from the callback is forwarded to the attacker's controlled URL, allowing token theft and subsequent impersonation.

Scenario 3: Internal Service Pivoting

1. The attacker submits URLs that resolve to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
2. They probe internal services like databases (port 3306, 5432), admin panels (port 8080, 9200), or Kubernetes API servers (port 6443) by crafting the URL path accordingly.
3. Each response is returned through the application, enabling data extraction or reconnaissance of the internal network.

Impact Assessment

Business Impact: The confidentiality impact is rated as High (C:H) in the CVSS vector. An attacker can gain access to cloud metadata services, which typically contain IAM credentials. If the Open WebUI instance runs on a cloud VM with a service account, the attacker can escalate to full cloud account compromise.

Affected Systems: All self-hosted Open WebUI deployments prior to version 0.11.0, particularly:

• Cloud-hosted instances (AWS, GCP, Azure) where metadata services exist
• Instances in corporate environments with internal services
• Multi-tenant or externally accessible instances with user registration enabled

Blast Radius: The vulnerability has a Changed scope (S:C) in CVSS, meaning the compromised component impacts resources beyond its security scope. The integrity and availability impact are None (I:N, A:N), but the confidentiality impact is High.

CVSS Subscores: The overall score of 6.3 reflects the balance between the high confidentiality impact and the mitigations: high attack complexity (AC:H) requires DNS control, and low privileges (PR:L) require an authenticated account. The network vector (AV:N) and no user interaction (UI:N) make remote exploitation feasible.

CISA KEV: Not listed; the vulnerability is not known to have been exploited in the wild per KEV.

Detection Guidance

Sigma Rule

title: Open WebUI SSRF via DNS Rebinding - CVE-2026-54020
id: 65e9e0ae-3a61-4d45-8fbd-4f1428e91682
status: experimental
description: Detects multiple rapid DNS resolutions of the same hostname with different IP answers, indicating possible DNS rebinding attempts against Open WebUI
author: Valtersit Threat Intelligence
logsource:
  category: dns_query
  product: linux
detection:
  selection_domains:
    dns.query.name|endswith:
      - '.net'
      - '.com'
      - '.io'
  selection_answers:
    dns.answer|contains:
      - '169.254.169.254'
      - '127.0.0.1'
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.31.'
  timeframe: 5s
  condition: selection_domains and selection_answers
falsepositives:
  - Legitimate DNS responses with internal IPs (rare in production)
  - Split-horizon DNS configurations
level: high
tags:
  - attack.t1190
  - attack.t1090
  - cve.2026-54020

YARA Rule

rule OpenWebUI_SSRF_DNSRebinding_CVE_2026_54020 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects patterns in Open WebUI logs or network traffic indicating DNS rebinding attempts for CVE-2026-54020"
        cve = "CVE-2026-54020"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54020"
        date = "2026-01-15"
    strings:
        $a = "img_url" ascii wide nocase
        $b = "url_ingest" ascii wide nocase
        $c = "profile_picture" ascii wide nocase
        $d = ".169.254.169.254" ascii wide
        $e = "127.0.0.1" ascii wide
        $f = "metadata" ascii wide nocase
        $g = "dns_rebind" ascii wide nocase
        $h = "TOCTOU" ascii wide nocase
        $i = "ssrf" ascii wide nocase
    condition:
        (any of ($a,$b,$c)) and (any of ($d,$e,$f)) and 2 of ($g,$h,$i)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Open WebUI SSRF DNS Rebinding Attempt CVE-2026-54020"; flow:established,to_server; content:"img_url"; http_uri; nocase; content:"http"; http_uri; nocase; pcre:"/&(?:dns|hostname|url|uri|image|img)=[^&]*(?:169\.254\.169\.254|127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/i"; sid:2026540201; rev:1; reference:cve,2026-54020;)

Elastic Detection

sequence by host.name with maxspan=10s
  [ network where
    dns.question.name != null and
    dns.answers != null and
    // First answer is a public IP (validated OK)
    dns.answers.ip != null and
    not cidrMatch(dns.answers.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16")
  ]
  [ network where
    dns.question.name != null and
    dns.answers != null and
    // Second answer to same hostname is an internal/private IP
    dns.answers.ip != null and
    (cidrMatch(dns.answers.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"))
  ]
  [ process where process.name in ("open-webui", "python3", "python", "uvicorn") and
    process.args contains "url" or process.args contains "ingest" ]

Splunk SPL Query

index=dns earliest=-1h
| stats count as resolution_count values(dns.answer) as answers by hostname client_ip
| where resolution_count > 1
| eval has_public = if(match(join(answers, ","), "(?<!\d)(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)(?!\d)"), 1, 0)
| eval has_private = if(match(join(answers, ","), "(?<!\d)(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})(?!\d)"), 1, 0)
| where has_public==1 AND has_private==1
| table _time hostname client_ip answers resolution_count
| sort - _time

Wazuh OSSEC Rule

<group name="openwebui,">
  <rule id="202546" level="12">
    <if_sid>5700</if_sid>
    <field name="event.outcome">success</field>
    <regex>dns.*(answer|resolution).*(169\.254\.169\.254|127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3})</regex>
    <description>CVE-2026-54020: Open WebUI DNS rebinding attempt detected - internal address resolved after public validation.</description>
    <group>ssrf,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
    <alert_level>12</alert_level>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — The patch is claimed by a single source (NVD) and has not been independently confirmed, though vendor fix has been announced.

Immediate Mitigations (before patching):

1. Disable OAuth integrations or restrict OAuth profile-picture fetching if not essential, as this is the path that leaks OAuth access tokens.
2. Disable or restrict URL ingest and image URL fetching features in user-facing configurations.
3. If the platform uses a cloud metadata service (AWS, GCP, Azure), implement IMDSv2 with a required token (AWS) to add an extra layer of authentication that a simple HTTP request to the metadata service would fail without.
4. Apply network-level egress filtering to block outbound connections to private IP ranges, loopback, and link-local addresses from the Open WebUI host. Use a firewall or iptables rules to prevent the application from reaching 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, and 169.254.0.0/16.
5. Restrict user registration to trusted personnel only — disable open registration if possible.
6. Monitor DNS logs for anomalous resolution patterns, particularly hostnames that resolve to multiple different IPs in rapid succession.

Patch/Upgrade Steps:

1. Upgrade Open WebUI to version 0.11.0 or later, where the vulnerability is fixed.
2. Verify the upgrade by checking the dashboard version indicator or running open-webui --version in the deployment environment.
3. After upgrading, validate the fix by attempting to submit a URL pointing to a hostname that resolves to 169.254.169.254 — the platform should reject it both during validation and connection.
4. Confirm all deployment methods are updated: Docker containers, pip installations, pipx, or source builds — update all instances hosts.

Long-term Hardening:

1. Place Open WebUI behind a reverse proxy that enforces URL allow-listing and SSRF protections at the network layer.
2. Implement a Web Application Firewall (WAF) with SSRF-specific rules that inspect URL submissions.
3. Use dedicated DNS resolvers that return consistent results to avoid split-horizon discrepancies.
4. Regularly review and rotate cloud IAM credentials and OAuth tokens, assuming potential exposure.
5. Monitor for any unauthorized use of OAuth tokens or unusual access to metadata endpoints in cloud provider audit logs.
6. Subscribe to Open WebUI security advisories and release notes for future vulnerability announcements.

References

1. NVD Entry — CVE-2026-54020: https://nvd.nist.gov/vuln/detail/CVE-2026-54020
2. Open WebUI GitHub Repository (release history and v0.11.0 patch): https://github.com/open-webui/open-webui/releases
3. Open WebUI Official Documentation: https://docs.openwebui.com/
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: https://cwe.mitre.org/data/definitions/367.html

Known Exploitation Activity: No public exploit code or in-the-wild exploitation has been confirmed at the time of writing. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. Research into the specific DNS rebinding technique used here parallels established SSRF bypass research and is well-documented in public literature on DNS rebinding attacks.