CVE-2025-29446

open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verify_connection.

CVSS

No CVSS.

References

Link	Resource
https://github.com/jcxj/jcxj/blob/master/source/_posts/open-webui-ssrf%E6%BC%8F%E6%B4%9E.md	Broken Link
https://github.com/l1uyi/cve-list/blob/main/cve-list/open-webui-ssrf.md	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:0.5.16:*:*:*:*:*:*:*

History

28 May 2025, 15:49

Type	Values Removed	Values Added
CPE		cpe:2.3:a:openwebui:open_webui:0.5.16:::::::*
First Time		Openwebui Openwebui open Webui
References	~~() https://github.com/jcxj/jcxj/blob/master/source/_posts/open-webui-ssrf%E6%BC%8F%E6%B4%9E.md -~~	() https://github.com/jcxj/jcxj/blob/master/source/_posts/open-webui-ssrf%E6%BC%8F%E6%B4%9E.md - Broken Link
References	~~() https://github.com/l1uyi/cve-list/blob/main/cve-list/open-webui-ssrf.md -~~	() https://github.com/l1uyi/cve-list/blob/main/cve-list/open-webui-ssrf.md - Exploit, Third Party Advisory

21 Apr 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-21 17:15

Updated : 2025-05-28 15:49

NVD link : CVE-2025-29446

Mitre link : CVE-2025-29446

JSON object : View

Products Affected

openwebui

CWE

No CWE.