mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-15 23:32:40 +00:00
66126f3861
Starlette reconstructs request.url.path from the HTTP Host header without validation. An attacker can inject a path into the Host header to make request.url.path return a different value than the path Starlette routes on. The API key endpoint restriction check was using request.url.path to decide whether to allow or deny access — making it bypassable via a crafted Host header on any Starlette version prior to 1.0.1. Fix: replace request.url.path with request.scope["path"], which reads the raw ASGI scope path that Starlette uses for routing. This value is set by the ASGI server from the actual request path and cannot be injected via HTTP headers, making it safe regardless of Starlette version. Affected code path: get_current_user_by_api_key() in backend/open_webui/utils/auth.py (only triggered when ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS is enabled) References: CVE-2026-48710 / BadHost https://arstechnica.com/information-technology/2026/05/millions-of-ai-agents-imperiled-by-critical-vulnerability-in-open-source-package/ |
||
|---|---|---|
| .. | ||
| access_control | ||
| images | ||
| mcp | ||
| telemetry | ||
| actions.py | ||
| anthropic.py | ||
| asgi_middleware.py | ||
| audit.py | ||
| auth.py | ||
| automations.py | ||
| calendar.py | ||
| channels.py | ||
| chat.py | ||
| code_interpreter.py | ||
| embeddings.py | ||
| files.py | ||
| filter.py | ||
| groups.py | ||
| headers.py | ||
| logger.py | ||
| middleware.py | ||
| misc.py | ||
| models.py | ||
| oauth.py | ||
| payload.py | ||
| pdf_generator.py | ||
| plugin.py | ||
| rate_limit.py | ||
| redis.py | ||
| response.py | ||
| sanitize.py | ||
| security_headers.py | ||
| session_pool.py | ||
| task.py | ||
| tools.py | ||
| validate.py | ||
| webhook.py | ||