CVE-2026-87996: Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
open_webuito a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it if they control authoritative DNS for a hostname. They can cause the hostname to resolve to a public address during validation and to an internal address when Playwright later fetches it.
Which deployments are affected?
Open WebUI versions from 0.9.6 up to, but not including, 0.11.1 are affected when users can use web search or URL ingestion through the Playwright web loader.
What data could be exposed?
The issue can expose responses from internal services or cloud metadata endpoints to the authenticated attacker through web search or URL ingestion.
What is the available remediation?
Upgrade Open WebUI to version 0.11.1, which fixes the DNS rebinding issue in SafePlaywrightURLLoader.