Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.
Published: 2026-09-09
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: Server Side Request Forgery (internal data exposure)
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in SafePlaywrightURLLoader, which validates a hostname supplied by an authenticated user but then allows a second resolution by Playwright. An attacker with authority over DNS can give the loader a public address that satisfies validation and an internal address that Playwright resolves, causing the system to retrieve responses from internal services or cloud metadata. The breach can expose sensitive internal data and is a classic SSRF via DNS rebinding.

Affected Systems

Open WebUI, versions 0.9.6 through 0.11.1. The issue is fixed in version 0.11.1 and later.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user who can influence DNS resolution. The attacker can then read responses from internal endpoints, potentially leaking confidential information or gaining further footholds in the internal network.

Generated by OpenCVE AI on September 9, 2026 at 22:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Open WebUI to version 0.11.1 or later, which removes the vulnerable URL loader.
  • Configure DNS controls or modify the SafePlaywrightURLLoader to reject internally resolvable addresses, preventing DNS rebinding from succeeding.
  • Deploy network segmentation or firewall rules that block outbound requests from the Playwright component to internal IP ranges, limiting the impact of any residual SSRF capabilities.

Generated by OpenCVE AI on September 9, 2026 at 22:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.
Title Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Weaknesses CWE-367
CWE-918
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-09T21:28:10.758Z

Reserved: 2026-09-09T19:19:27.405Z

Link: CVE-2026-87996

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-09T22:18:47.857

Modified: 2026-09-09T22:18:47.857

Link: CVE-2026-87996

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T22:45:06Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition

  • CWE-918

    Server-Side Request Forgery (SSRF)