HIGH

CVE-2025-65958

CVSS v3

7.1

HIGH

EPSS Score

4.4 %

exploit probability, as of 2026-09-25

CISA KEV

known exploited

Exploitation

—

SSVC status

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.

Technical details

Published: 2025-12-04

Frequently asked questions

What is CVE-2025-65958?

Is CVE-2025-65958 actively exploited?

Active exploitation of CVE-2025-65958 has not been confirmed. Its EPSS score was 4.4% on 2026-09-25, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-65958?

CVE-2025-65958 has a CVSS v3 base score of 7.1 (HIGH severity).

Is CVE-2025-65958 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database