Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-70479
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- September 18, 2026
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEB_LOADER_ENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated user can use JavaScript to reach blocked internal addresses, and returned DOM can include data read from those addresses in web-search or RAG output. This issue is fixed in 0.11.0.
Description quoted from the NVD record.
Who is affected
This flaw affects Open WebUI, a self-hosted chat interface for using AI models, in versions 0.9.6 up to but not including 0.11.0. It applies only when Open WebUI is set to use the Playwright engine to load web pages. In that setup, the part that fetches web pages checks only the main page address and lets through, unchecked, the extra pieces the page loads. A user with an account could supply a page that reaches internal addresses that should be blocked. Information read from those addresses could then appear in web search results or in answers that draw on documents. This flaw is rated High.
What to do
- If you or someone in your organization installed and runs Open WebUI, that person should update it to version
0.11.0or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update will be done.
- Ask whoever runs it whether Open WebUI is set to use the Playwright engine for loading web pages. Only that setup is affected, but the update is the fix either way.
- Use the vendor advisory linked on this page for the update steps that match your setup.
Analysis written from the source record as of September 18, 2026 and reviewed before publishing.