8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45401

CVE-2026-45401: Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the validate_url() function in backend/open_webui/retrieval/web/utils.py only validates the initial URL submitted by the caller. The HTTP clients used downstream (sync requests, async aiohttp, langchain's WebBaseLoader) follow HTTP 3xx redirects by default and do not re-validate the redirect target against the private-IP / metadata-IP block list. Any authenticated user can therefore submit a public URL that 302-redirects to an internal address (e.g. 127.0.0.1, 169.254.169.254, RFC1918) and read the internal response body via the /api/v1/retrieval/process/web endpoint, the /api/v1/images/... endpoints, the /api/chat/completions endpoint with an image_url content part, and any other route that calls these helpers. This vulnerability is fixed in 0.9.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45401

CVE-2026-45401:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	<= 0.9.4	0.9.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) caused by the application's HTTP clients following HTTP redirects by default. The core of the issue is that while the application validates the initial URL provided by the user to prevent requests to internal or private IP addresses, it fails to perform the same validation on the URLs provided in Location headers during an HTTP 3xx redirect. An attacker can exploit this by providing a seemingly safe, public URL that redirects to a sensitive internal endpoint (e.g., 127.0.0.1, cloud metadata services like 169.254.169.254, or other services on the local network). The server, upon receiving the redirect, would then make a request to the internal service and return its response to the attacker.

The analysis of the patches between the vulnerable version 0.9.4 and the patched version 0.9.5 confirms this root cause. The patches consistently add allow_redirects=False to HTTP client calls across multiple code paths. The identified vulnerable functions are those that were making HTTP requests without this parameter set. Specifically:

get_content_from_url in backend/open_webui/retrieval/utils.py used requests.get.
SafeWebBaseLoader in backend/open_webui/retrieval/web/utils.py inherited a vulnerable _scrape method, which was fixed by modifying the constructor to disable redirects.
load_url_image in backend/open_webui/routers/images.py used aiohttp.ClientSession.get.
get_image_base64_from_url in backend/open_webui/utils/files.py, used in the chat functionality, also used aiohttp.ClientSession.get.

By disabling redirects in these key functions, the patch ensures that only the initially validated URL is ever contacted, thus closing the SSRF loophole.

Vulnerable functions

get_content_from_url

backend/open_webui/retrieval/utils.py

This function fetches content from a URL using `requests.get` without disabling redirects. An attacker could provide a URL that redirects to an internal service, and the function would follow the redirect and return the content of the internal service, leading to an SSRF vulnerability.

SafeWebBaseLoader.__init__

backend/open_webui/retrieval/web/utils.py

This class inherits from `langchain_community.document_loaders.WebBaseLoader`. The parent's `_scrape` method uses `requests.Session.get`, which follows redirects by default. The vulnerability was that `SafeWebBaseLoader` did not override this behavior. The fix in the constructor prevents this by default for all instances, mitigating an SSRF vulnerability where an initial public URL could redirect to an internal one.

load_url_image

backend/open_webui/routers/images.py

This function fetches an image from a URL for editing. It used `aiohttp` to get the image, which follows redirects by default. An attacker could supply a URL that redirects to an internal service, causing the server to make a request to that internal service and return the response, leading to SSRF.

get_image_base64_from_url

backend/open_webui/utils/files.py

This function is used in the chat completions middleware to handle images from URLs. It used `aiohttp` to fetch the image, which by default follows redirects. This allowed any authenticated user to trigger an SSRF by providing a redirecting image URL in a chat message, making it a highly reachable vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.