Open WebUI performed hostname validation by resolving DNS at input time, but the outgoing HTTP client resolved the same hostname again when establishing the connection. This double‑resolution allowed an attacker who controls the authoritative DNS reply to let the validation step see a public address while the connection step resolves to a private, internal address. Consequently the authenticated attacker could force the server to fetch resources from cloud metadata services, local administrative interfaces, or other internal endpoints and receive the responses. The vulnerability is essentially a server‑side request forgery that can leak sensitive data or credentials, including OAuth access tokens forwarded by the OAuth profile‑picture path.

The issue is present in all releases of the open-webui platform before version 0.11.0, including the 0.10.x and 0.9.x series. Any deployment that utilizes the Open WebUI application—self‑hosted instances that expose URL ingestion, chat image URL fetching, image editing, or OAuth profile‑picture retrieval—is affected.

The CVSS score of 6.3 indicates moderate severity. No EPSS score is available and the flaw is not listed in CISA KEV, implying limited known exploitation. An attacker must be authenticated and must control the DNS record for the supplied hostname to exploit the flaw. Once these conditions are met, the attacker can trigger internal service requests, potentially exfiltrating data or tokens. The primary attack vectors are the authenticated URL ingestion and image handling features, with the OAuth profile picture fetch providing a direct path to credential leakage.