CVE-2026-45400 — Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url`

Affected: open-webui

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability. This vulnerability is fixed in 0.9.5.

PYSEC-2026-2715 — Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`

Affected: PyPI: open-webui

### Summary In the open-webui project, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability.

### Details In the current project, URL validation is performed using the function validate_url.

The current checking logic uses urlparse to parse the hostname part of the URL for verification.

However, there are actually differences in parsing between urlparse and the library that actually sends the request. For example, in files.py, validate_url is used first for URL validation, and then requests.get is used to send the request.

The core issue: `urlparse()` and `requests` disagree on which host a URL like `http://127.0.0.1:6666\@1.1.1.1` points to:

- `urlparse()` treats `\` as a regular character and `@` as the userinfo-host delimiter, so it extracts hostname as `1.1.1.1` (public) - `requests` treats `\` as a path character, connecting to `127.0.0.1` (internal)

Below is a test code I wrote following the open-webui code. ``` from __future__ import annotations

import ipaddress import log…

Most recent entries from all

CVE-2026-45400 — Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url`

PYSEC-2026-2715 — Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`