Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the validate_url() function in backend/open_webui/retrieval/web/utils.py only validates the initial URL submitted by the caller. The HTTP clients used downstream (sync requests, async aiohttp, langchain's WebBaseLoader) follow HTTP 3xx redirects by default and do not re-validate the redirect target against the private-IP / metadata-IP block list. Any authenticated user can therefore submit a public URL that 302-redirects to an internal address (e.g. 127.0.0.1, 169.254.169.254, RFC1918) and read the internal response body via the /api/v1/retrieval/process/web endpoint, the /api/v1/images/... endpoints, the /api/chat/completions endpoint with an image_url content part, and any other route that calls these helpers. This vulnerability is fixed in 0.9.5.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior
    to 0.9.5, the validate_url() function in backend/open_webui/retrieval/web/utils.py only validates the
    initial URL submitted by the caller. The HTTP clients used downstream (sync requests, async aiohttp,
    langchain's WebBaseLoader) follow HTTP 3xx redirects by default and do not re-validate the redirect target
    against the private-IP / metadata-IP block list. Any authenticated user can therefore submit a public URL
    that 302-redirects to an internal address (e.g. 127.0.0.1, 169.254.169.254, RFC1918) and read the internal
    response body via the /api/v1/retrieval/process/web endpoint, the /api/v1/images/... endpoints, the
    /api/chat/completions endpoint with an image_url content part, and any other route that calls these
    helpers. This vulnerability is fixed in 0.9.5. (CVE-2026-45401)

The version of Open WebUI running on the remote host is prior to 0.9.5. It is, therefore, affected by multiple vulnerabilities:

  - An insecure direct object reference (IDOR) vulnerability in the retrieval API allows any authenticated user who     knows a private knowledge base UUID to bypass access controls and read, inject content into, or destroy another     user's knowledge base. The _validate_collection_access() function only checks user-memory-* and file-* collection     name prefixes but does not validate knowledge base collections which use raw UUIDs. (CVE-2026-45398)

  - A server-side request forgery (SSRF) vulnerability exists because the validate_url() function only validates the     initial URL submitted by the caller. HTTP clients used downstream follow 3xx redirects by default without     re-validating the redirect target against the private-IP block list. Any authenticated user can submit a public URL     that redirects to an internal address and read the response. (CVE-2026-45401)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
442453	SCA: security update for open-webui (GHSA-rh5x-h6pp-cjj6)	Tenable Cloud Security	SCA Checks	Local	high
442453	SCA: security update for open-webui (GHSA-rh5x-h6pp-cjj6)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
314912	Open WebUI < 0.9.5 Multiple Vulnerabilities	Nessus	Artificial Intelligence	Remote	high

Detections

Analytics

CVE-2026-45401

high

Tenable Plugins

high

high

high