Time-of-check Time-of-use (TOCTOU) Race Condition in Open WebUI - CVE-2026-54020
Published: August 3, 2026
Vulnerability identifier: #VU140763
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54020
CWE-ID: CWE-367
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from internal services.
The vulnerability exists due to a time-of-check time-of-use race condition in server-side URL fetch handlers when processing user-supplied URLs. A remote user can control authoritative DNS responses for a submitted hostname to make the server connect to an internal address and disclose sensitive information from internal services.
Most affected fetch paths return the internal response to the user, while the image-edit path is blind. On the OAuth profile-picture fetch path, the server also forwards the OAuth access token as a Bearer header to the fetched URL.
Affected software
Open WebUI
How to mitigate CVE-2026-54020
Install security update from vendor's website.
Open WebUI - update to 0.11.0