Securaity Browse advisories
SA-26-075 High

Open WebUI: Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints…

Open WebUI

More for Open WebUI RSS feed for Open WebUI

Severity
High, CVSS 8.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Record
CVE-2026-45401
Affects
Open WebUI
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
May 15, 2026
Source last modified
June 17, 2026

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the validate_url() function in backend/open_webui/retrieval/web/utils.py only validates the initial URL submitted by the caller. The HTTP clients used downstream (sync requests, async aiohttp, langchain's WebBaseLoader) follow HTTP 3xx redirects by default and do not re-validate the redirect target against the private-IP / metadata-IP block list. Any authenticated user can therefore submit a public URL that 302-redirects to an internal address (e.g. 127.0.0.1, 169.254.169.254, RFC1918) and read the internal response body via the /api/v1/retrieval/process/web endpoint, the /api/v1/images/... endpoints, the /api/chat/completions endpoint with an image_url content part, and any other route that calls these helpers. This vulnerability is fixed in 0.9.5.

Description quoted from the NVD record.

Who is affected

Open WebUI is a self-hosted chat interface for working with AI language models. This flaw affects versions before 0.9.5. Any user with an account can give the product a public web address that quietly forwards to a private one, such as the server itself, other machines on your internal network, or the internal information service of a cloud server. The product then fetches that private page and shows its contents to the user. The problem is in the features that fetch web pages for chats and load images, including images added to chat messages. This flaw is rated High.

What to do

  1. Find out who looks after Open WebUI for your organization: the person who installed it or runs it, or the IT provider or vendor that manages it for you.
  2. If you run it yourselves, that person should check which version is installed. If it is older than 0.9.5, they should update to 0.9.5 or later, which fixes this flaw.
  3. If an IT provider or vendor runs it for you, send them this advisory and ask when the update to 0.9.5 will be done.

Analysis written from the source record as of June 17, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all