CVE-2026-45401General(openwebui / open_webui)

LOWCVSS 8.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the validate_url() function in backend/open_webui/retrieval/web/utils.py only validates the initial URL submitted by the caller. The HTTP clients used downstream (sync requests, async aiohttp, langchain's WebBaseLoader) follow HTTP 3xx redirects by default and do not re-validate the redirect target against the private-IP / metadata-IP block list. Any authenticated user can therefore submit a public URL that 302-redirects to an internal address (e.g. 127.0.0.1, 169.254.169.254, RFC1918) and read the internal response body via the /api/v1/retrieval/process/web endpoint, the /api/v1/images/... endpoints, the /api/chat/completions endpoint with an image_url content part, and any other route that calls these helpers. This vulnerability is fixed in 0.9.5.

openwebui CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

open_webui

Threat summary

Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-05-16); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

openwebui

Products

open_webui

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Disclosure

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-16	1	General1
2026-05-20	1	Disclosure1

Full discourse2 posts

chinayak_@nayakchinmohan141d
Disclosure
🚨 I found a critical SSRF in Open WebUI (CVE-2026-45401) It had: URL validation (including outbound IP checks) ✅ And it still allowed access to internal infrastructure. The issue? Validation happens before redirects — but execution happens after. → SSRF via redirect chaining → Access to cloud metadata (169.254.169.254) → Potential credential exposure This class of bugs will keep showing up in AI platforms too. Full writeup 👇 https://medium.com/@chinmohannayak/breaking-ai-platforms-how-an-ssrf-in-open-webui-enabled-internal-network-access-cve-2026-45401-dbffc30295fc #Cybersecurity #AISecurity #AppSec #LLM
Post summary
A critical SSRF vulnerability (CVE‑2026‑45401) in Open WebUI bypasses URL validation and allows internal network access via redirect chaining, with a detailed Medium article linked for more information.
00011260
98 followersView on X
CVE@CVEnew146d
General
CVE-2026-45401 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the validate_url() function in backend/open_webui/r… https://www.cve.org/CVERecord?id=CVE-2026-45401
Post summary
The post references CVE-2026-45401 and notes a pre‑0.9.5 validate_url() function, but provides no concrete technical details, PoC, patch, or evidence of exploitation, categorising it as a general mention.
00000195
57.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openwebui	open_webui	-	-	-

Explore more

Back to dashboard openwebui CVEs open_webui vulnerabilities