CVE-2024-7959
| CVE ID | CVE-2024-7959 |
| Vendor Disposition | Rejected, out of scope; severity inflated |
| Official Resolution | Withdrawn by the issuing CNA on 2026-07-16; the record is REJECTED |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | High (CVSS 7.7, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) |
The issuing CNA has withdrawn the record, so the official CVE entry now carries the REJECTED state and NVD and downstream feeds inherit it. The public record now matches Open WebUI's vendor disposition below, confirming our assessment that this was not a genuine vulnerability. There is no advisory and no affected Open WebUI release.
Timeline
This CVE was withdrawn by its issuing CNA after review. Open WebUI's assessment below is the basis on which the record was rejected.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-08 | Open WebUI publishes this disposition, rejecting the report as out of scope; severity inflated. |
| 2026-07-08 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-07-16 | Officially rejected huntr / Protect AI accepts the dispute and withdraws the record. The CVE record is now officially REJECTED. |
| Still open | The huntr report page has not followed the withdrawal. The report is still shown as Valid with a green check and its status as "Awaiting fix", while the CVE field on the same page reads Rejected. |
| 2026-08-08 | Open WebUI asks huntr / Protect AI to bring the report validity and fix status in line with the withdrawal, and to make those fields follow CVE state transitions so it does not recur. Awaiting response. |
| 2026-08-14 | With huntr / Protect AI unresponsive on that request, Open WebUI raises the matter with the CVE Program, asking that records withdrawn by the CNA no longer be presented as valid and awaiting a fix. CNA Rule 4.5.2.3 states that a CNA's published vulnerability information "MUST generally support and MUST NOT contradict information published by the CNA in corresponding CVE Records". |
The record is now in the REJECTED state on cve.org, and that state propagates to NVD and downstream feeds. No action is required from users, and the CVE should not be treated as an Open WebUI vulnerability.
What the CVE Claims
The report claims a Server-Side Request Forgery in the /openai/models endpoint. It states that "a user can change the OpenAI URL to any URL without checks", so the endpoint sends a request to that URL and returns the output, which could reach internal services and, by hitting a cloud metadata endpoint such as http://169.254.169.254, retrieve instance secrets. Its proof of concept first calls POST /openai/urls/update to set the provider URL, then GET /openai/models/0 to trigger the fetch. It is classified as CWE-918 (SSRF) and scored PR:L / S:C (7.7 High).
Why This Is Out of Scope
Changing a provider URL is an administrator-only configuration action. The setter used by the report's own proof of concept, POST /openai/urls/update (the update_openai_urls handler in v0.3.8, consolidated into update_config today), is gated by Depends(get_admin_user). The report's premise, that "a user can change the OpenAI URL", is incorrect: its own reproduction requires an administrator token to perform the URL update before the subsequent fetch does anything. The /openai/models handler can only reach a URL an administrator has already configured, so the party who controls the destination is the administrator, not an unprivileged attacker.
Configuring a Provider URL, Including an Internal One, Is Intended Functionality
Pointing Open WebUI at an OpenAI-compatible endpoint, including an internal or self-hosted one on a private network, is the entire purpose of the connection settings. An administrator entering an internal URL is using the feature as designed. The report's worst-case impact, reaching a cloud metadata endpoint and reading instance secrets, is in any case already within an administrator's reach: administrators can install Tools and Functions that execute arbitrary Python (see Rule 10) and can therefore make that same request to 169.254.169.254, read the instance's secrets or reach any internal service directly. The provider URL field grants no reach an administrator does not already have.
A Directly Comparable Record Was Already Rejected by the CVE Program
This is the same class of report as CVE-2025-29446: an SSRF in which an administrator sets a model-provider URL (there, the Ollama connection's verify_connection endpoint) that the server then contacts. That record was formally disputed and withdrawn by its issuing CNA (MITRE) after review as not a security issue, and its REJECTED state is now inherited by NVD and downstream feeds. CVE-2024-7959 describes the identical pattern on the OpenAI connection rather than the Ollama one; the report even cites the Ollama code path (backend/apps/ollama/main.py) alongside the OpenAI one. The adjudication that resolved CVE-2025-29446 applies directly to this record.
Inflated Severity
The published CVSS scores privileges required as PR:L (low) and marks a scope change (S:C), inflating the base score to 7.7 (High). Both are inaccurate. Setting the destination requires an administrator (PR:H), and there is no crossing into a security scope the administrator does not already control (S:U). Corrected, the vector does not describe a High-severity, low-privilege issue.
Applicable Security Policy Rules
- Rule 9: Setting a provider URL requires an administrator. Administrators have full system control and are expected to understand the implications of the endpoints they configure, including pointing them at internal hosts.
- Rule 8: The CVSS vector is inaccurate. The configuration action requires PR:H, not PR:L, and there is no scope change (S:C) against a party other than the configuring administrator.
- Rule 7: The report does not account for Open WebUI's self-hosted, role-based architecture, in which administrators deliberately configure model-provider URLs, including internal ones.
Impact to Users
No action required. Only an administrator can set a provider URL, and doing so is intended functionality used to connect internal and self-hosted model servers. No unprivileged user can direct the endpoint at an arbitrary host.