CVE-2026-45401: Open WebUI SSRF bypass via HTTP redirect following

CVE-2026-45401 · Severity: high · CVSS 8.5 · Published 2026-05-15

Open WebUI, an interface for large language models, is vulnerable to a security flaw where authenticated users can trick the server into accessing internal network resources. By providing a specially crafted web link that redirects to a private address, an attacker can view sensitive internal data, such as cloud configuration details or local database information. This could lead to the exposure of private infrastructure details and unauthorized access to internal services.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-45401 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45401 being exploited in the wild.
How severe is CVE-2026-45401?
High severity, with a CVSS score of 8.5, published 15 May 2026.
Which products and versions are affected?
open-webui (PyPI) <= 0.9.4, ECOSYSTEM:introduced=0,fixed=0.9.5.
Is there a fix for CVE-2026-45401?
Yes. open-webui (PyPI): upgrade to 0.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45401 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45401?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.9.5 or later
    pip install "open-webui>=0.9.5"

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Open WebUI due to improper validation of HTTP redirects. While the 'validate_url()' function checks the initial URL against a blocklist of private and metadata IP addresses, the underlying HTTP clients (requests, aiohttp, and LangChain's WebBaseLoader) follow 3xx redirects by default without re-validating the destination. An authenticated attacker can exploit this by submitting a URL that redirects to internal addresses like 127.0.0.1 or 169.254.169.254. This affects multiple components including web retrieval, image loading, and chat completion middleware. The vulnerability is addressed in version 0.9.5 by disabling automatic redirects or implementing per-hop validation.

Affected products

  • Open WebUI open-webui <= 0.9.4

Identifiers

  • CVE-2026-45401
  • GHSA-rh5x-h6pp-cjj6
  • PYSEC-2026-2755

Timeline

  • 2026-05-10: disclosed
  • 2026-05-14: advisory
  • 2026-05-14: patched: Fixed in version 0.9.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.