CVE-2026-45400

High

Published: 15/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.9.5, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability.

Risk Assessment

This vulnerability could allow attackers to bypass SSRF protections, potentially leading to unauthorized access to internal resources. Organizations using versions prior to 0.9.5 should exercise caution.

Recommendation

It is recommended to upgrade Open WebUI to version 0.9.5 or later to mitigate this vulnerability. Regular monitoring and updating of software is crucial for maintaining security.

Original NVD description (English source)

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability. This vulnerability is fixed in 0.9.5.