I have searched the existing issues and discussions.
Problem Description
Allowing user-defined webhooks introduces a security vulnerability. This occurs because webhook requests are initiated directly from the server hosting the open-webui backend.
Impact:
Leakage of the backend server's IP address.
Increased risk of information disclosure and targeted attacks against the server infrastructure.
Desired Solution you'd like
Having a switch inside the admin panel, or a environment variable that will block the sending of webhooks
Or at least only allow well known webhooks urls
Alternatives Considered
No response
Additional Context
No response
Originally created by @konfusee on GitHub (Mar 12, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/11607
Originally assigned to: @tjbck on GitHub.
### Check Existing Issues
- [x] I have searched the existing issues and discussions.
### Problem Description
Allowing user-defined webhooks introduces a security vulnerability. This occurs because webhook requests are initiated directly from the server hosting the open-webui backend.
Impact:
- Leakage of the backend server's IP address.
- Increased risk of information disclosure and targeted attacks against the server infrastructure.
### Desired Solution you'd like
Having a switch inside the admin panel, or a environment variable that will block the sending of webhooks
Or at least only allow well known webhooks urls
### Alternatives Considered
_No response_
### Additional Context
_No response_
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @konfusee on GitHub (Mar 12, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/11607
Originally assigned to: @tjbck on GitHub.
Check Existing Issues
Problem Description
Allowing user-defined webhooks introduces a security vulnerability. This occurs because webhook requests are initiated directly from the server hosting the open-webui backend.
Impact:
Desired Solution you'd like
Having a switch inside the admin panel, or a environment variable that will block the sending of webhooks
Or at least only allow well known webhooks urls
Alternatives Considered
No response
Additional Context
No response
@tjbck commented on GitHub (Mar 31, 2025):
Addressed with
33f93371dc