Open WebUI存在信息泄露(CVE-2026-45397)

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/cve-2026-45397
• https://github.com/open-webui/open-webui/security/advisories/GHSA-65pg-qhhw-mxwg
• https://vuldb.com/cve/CVE-2026-45397
• https://advisories.gitlab.com/pypi/open-webui/CVE-2026-45397/
• https://bitninja.com/blog/cve-2026-45397-unauthenticated-exposure-in-open-webui/
• https://access.redhat.com/security/cve/cve-2026-45397
• https://security.snyk.io/vuln/SNYK-PYTHON-OPENWEBUI-16725479

Related Vulnerabilities

• PoCCVE-2026-58123: Hermes WebUI < 0.51.788 - Remote Code Execution
• Open WebUI /api/v1/retrieval/process/web 服务器端请求伪造漏洞（CVE-2026-70485）
• PoCNginxWebUI /adminPage/login/getAuth 命令执行漏洞
• PoCNginxWebUI /Adminpage/Conf/loadOrg 文件读取漏洞
• NginxWebUI /Api/Nginx/runNginxCmd 命令执行漏洞
• NginxWebUI /Adminpage/Remote/cmdOver 命令执行漏洞
• PoCCVE-2026-44551: Open WebUI 'LDAP Empty Password' - Authentication Bypass
• PoCCVE-2026-45397: Open WebUI < 0.9.5 - Information Disclosure
• Open WebUI /api/v1/retrieval/ 信息泄露漏洞（CVE-2026-45397）
• PoCCVE-2024-4322: LoLLMS WebUI < 9.8 - Path Traversal
• LoLLMS WebUI存在路径遍历漏洞(CVE-2024-4322)
• 思科系统（中国）网络技术有限公司Cisco AP WebUI存在弱口令
• PoCOpen WebUI /api/v1/auths/signin 默认口令漏洞