CVE-2026-45401
HighSummary
In versions prior to 0.9.5, the validate_url() function in Open WebUI does not validate HTTP 3xx redirects, allowing authenticated users to access internal IP addresses via public URLs. This may lead to unauthorized reading of data from internal resources.
Risk Assessment
The organization may be exposed to data leaks from internal systems, posing a serious threat to information security.
Recommendation
It is recommended to update Open WebUI to version 0.9.5 or later to mitigate this vulnerability.
Original NVD description (English source)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the validate_url() function in backend/open_webui/retrieval/web/utils.py only validates the initial URL submitted by the caller. The HTTP clients used downstream (sync requests, async aiohttp, langchain's WebBaseLoader) follow HTTP 3xx redirects by default and do not re-validate the redirect target against the private-IP / metadata-IP block list. Any authenticated user can therefore submit a public URL that 302-redirects to an internal address (e.g. 127.0.0.1, 169.254.169.254, RFC1918) and read the internal response body via the /api/v1/retrieval/process/web endpoint, the /api/v1/images/... endpoints, the /api/chat/completions endpoint with an image_url content part, and any other route that calls these helpers. This vulnerability is fixed in 0.9.5.