Securaity Browse advisories
SA-26-614 High

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Open WebUI

More for Open WebUI RSS feed for Open WebUI

Severity
High, CVSS 7.7
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Record
CVE-2026-87996
Affects
Open WebUI
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
September 9, 2026
Source last modified
September 16, 2026

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.

Description quoted from the NVD record.

Who is affected

Open WebUI is a self-hosted chat interface that lets people work with AI models through a web browser. This flaw affects versions 0.9.6 up to, but not including, 0.11.1. It is in the part that fetches web pages for web search or when a web link is added. A signed-in user who controls the address lookup settings for a web domain could trick the safety check into approving a public address while the built-in browser actually visits a private one. That could expose responses from internal services on your network or internal information about your cloud servers. This flaw is rated High.

What to do

  1. If someone in your organization installed or runs Open WebUI, ask them to check which version is in use.
  2. If it is version 0.9.6 or later but older than 0.11.1, have them update to version 0.11.1 or later, which fixes this flaw.
  3. If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to 0.11.1 will be done.
  4. After the update, have the person who runs Open WebUI check that it now shows version 0.11.1 or later.

Analysis written from the source record as of September 16, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all