Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
- Record
- CVE-2026-70485
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 4, 2026
- Source last modified
- September 18, 2026
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in transition encodings. On a deployment with a NAT64 gateway, any verified user could wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval. This issue is fixed in 0.11.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat program you run on your own server for using AI models. This flaw affects versions 0.9.0 up to, but not including, 0.11.0. It matters only if your network uses a NAT64 gateway (a device that lets newer-style internet addresses reach older-style ones). There, any user with a verified account could make Open WebUI fetch pages from your internal systems or your cloud provider's private server information and read the results. This works through the features that pull in web pages for the AI, turn web pages into text, or fetch web search results. This flaw is rated High.
What to do
- The person who installed or runs Open WebUI for your organization should check which version is in use.
- If it is version 0.9.0 or later but older than 0.11.0, update to
0.11.0, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update to
0.11.0will be done. - No workaround is named for this flaw, so updating is the way to fix it, even if you are unsure whether your network uses a NAT64 gateway.
Analysis written from the source record as of September 18, 2026 and reviewed before publishing.