CVE-2026-45400HIGH 8.5EPSS p14.6%

CVE-2026-45400CVE-2026-45400

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability. This vulnerability is fixed in 0.9.5.

Scoring

CVSS 3.18.5 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
EPSS0.24% probability of exploitation · percentile 14.6% · 2026-06-19T12:03:05Z
Published2026-05-15
Last modified2026-05-19

Underlying weaknesses· 1

CWE-918

References

  1. https://github.com/open-webui/open-webui/security/advisories/GHSA-8w7q-q5jp-jvgx
  2. https://github.com/open-webui/open-webui/security/advisories/GHSA-8w7q-q5jp-jvgx

1

TypeTargetConfidenceTier
WeaknessServer-Side Request Forgery (SSRF)cwe-9180%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-45401
CVE
CVE-2025-64496
CVE
CVE-2026-45301
CVE
CVE-2026-44551
CVE
CVE-2026-44549
CVE
CVE-2026-44565
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.