CVE-2026-87996

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Published Sep 9, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.

Analysis

Technical impact

The vulnerability resides in SafePlaywrightURLLoader, which validates a hostname supplied by an authenticated user but then allows a second resolution by Playwright. An attacker with authority over DNS can give the loader a public address that satisfies validation and an internal address that Playwright resolves, causing the system to retrieve responses from internal services or cloud metadata. The breach can expose sensitive internal data and is a classic SSRF via DNS rebinding.

Affected Systems

Open WebUI, versions 0.9.6 through 0.11.1. The issue is fixed in version 0.11.1 and later.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user who can influence DNS resolution. The attacker can then read responses from internal endpoints, potentially leaking confidential information or gaining further footholds in the internal network.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

open-webui

affected

Version	Status	Constraints
`>= 0.9.6, < 0.11.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Open-webui

Version	Status	Scheme	Platform
`[0.9.6,0.11.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Open WebUI to version 0.11.1 or later, which removes the vulnerable URL loader.
Configure DNS controls or modify the SafePlaywrightURLLoader to reject internally resolvable addresses, preventing DNS rebinding from succeeding.
Deploy network segmentation or firewall rules that block outbound requests from the Playwright component to internal IP ranges, limiting the impact of any residual SSRF capabilities.

Generated by OpenCVE AI on September 9, 2026 at 22:44 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-4v28-j6q3-5m4r	Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.354% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/open-webui/open-webui/commit/27402ff210bfa253445720920dfb86b15a00327b
https://github.com/open-webui/open-webui/pull/28634
https://github.com/open-webui/open-webui/releases/tag/v0.11.1
https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r

History

Sep 16, 2026 3:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openwebui Openwebui open Webui
CPEs		cpe:2.3:a:openwebui:open_webui::::::::
Vendors & Products		Openwebui Openwebui open Webui

Sep 10, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 10, 2026 11:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Open-webui Open-webui open-webui
Vendors & Products		Open-webui Open-webui open-webui

Sep 9, 2026 9:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.
Title		Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Weaknesses		CWE-367 CWE-918
References		https://github.com/open-webui/open-webui/commit/27402ff210bfa253445720920dfb86b15a00327b https://github.com/open-webui/open-webui/pull/28634 https://github.com/open-webui/open-webui/releases/tag/v0.11.1 https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}`