The oobabooga text-generation-webui versions before 4.3 contain an SSRF vulnerability (CWE-918) in the superbooga and superboogav2 RAG extensions. These extensions use requests.get() to fetch URLs supplied by users without any validation, such as scheme checks, IP filtering, or hostname allowlisting. This lack of validation enables attackers to make unauthorized requests to internal services, including cloud metadata endpoints, which can lead to credential theft and internal network reconnaissance. The vulnerability is addressed in version 4.3 of the product.

An attacker can exploit this SSRF vulnerability to access sensitive internal resources, including cloud metadata endpoints, which may result in the theft of IAM credentials. This can lead to unauthorized access to cloud services and internal systems. The vulnerability does not impact integrity or availability directly but has a high confidentiality impact as indicated by the CVSS vector (C:H/I:N/A:N).

Upgrade to version 4.3 or later of the oobabooga text-generation-webui, where this SSRF vulnerability has been fixed. Since no official patch link or vendor advisory is provided, users should verify the upgrade from the official project repository or release notes. Patch status is not yet confirmed by a vendor advisory; check the vendor's official channels for the latest remediation guidance.