CVE-2026-70479 Overview
CVE-2026-70479 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Open WebUI, a self-hosted AI platform. The flaw exists in the Playwright web loader when WEB_LOADER_ENGINE=playwright is configured. Affected versions range from 0.9.6 through releases prior to 0.11.0. The loader validates only the top-level page request and permits sub-resource requests to bypass URL validation. An authenticated user can supply a page containing JavaScript that reaches blocked internal addresses. Data read from those internal addresses can then appear in web-search or Retrieval-Augmented Generation (RAG) output.
Critical Impact
Authenticated attackers can pivot the Open WebUI server into internal networks, reaching services otherwise blocked by URL allowlists and exfiltrating internal data through RAG responses.
Affected Products
- Open WebUI versions 0.9.6 through 0.10.x
- Deployments configured with WEB_LOADER_ENGINE=playwright
- Fixed in Open WebUI 0.11.0
Discovery Timeline
- 2026-08-04 - CVE-2026-70479 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70479
Vulnerability Analysis
Open WebUI uses Playwright to render pages when scraping content for web-search or RAG ingestion. The _intercept_navigation_sync route handler in backend/open_webui/retrieval/web/utils.py inspected the resource type of each intercepted request. Only requests where resource_type == 'document' were passed to validate_url(). All other resource types, including xhr, fetch, image, and script, were forwarded without validation.
An authenticated user submits a URL to an attacker-controlled page. The page passes the initial document check. JavaScript on the page then issues fetch() requests to internal addresses such as http://169.254.169.254/ or http://127.0.0.1:8080/. The returned DOM incorporates the response bodies and is returned as web-search or RAG context.
Root Cause
The root cause is incomplete URL validation scoped to a single resource type. The interceptor's early return for non-document requests bypassed validate_url() entirely. HTTP redirects on the document request were also not re-validated, permitting redirect-based SSRF against internal hosts.
Attack Vector
Exploitation requires authenticated access to Open WebUI and the Playwright web loader enabled. The attacker hosts a page that references internal targets via sub-resources or redirects. The Open WebUI backend renders the page server-side, reads internal responses, and returns them to the caller.
def _intercept_navigation_sync(self, route, request=None):
req = request or route.request
- if req.resource_type != 'document':
- route.continue_()
- return
-
try:
validate_url(req.url)
+ resp = route.fetch(max_redirects=0)
+
+ if 300 <= resp.status < 400:
+ for _ in range(20):
+ if not AIOHTTP_CLIENT_ALLOW_REDIRECTS:
+ route.abort()
+ return
+
+ location = resp.headers.get('location')
+ if not location:
+ break
+
+ url = urllib.parse.urljoin(resp.url, location)
+ validate_url(url)
+ resp = route.fetch(url=url, max_redirects=0)
+ if not 300 <= resp.status < 400:
+ break
+ else:
+ route.abort()
+ return
except Exception:
Source: GitHub Commit bef63a2. The patch removes the resource-type early return, validates every intercepted URL, and re-validates each redirect target manually with a bounded redirect count.
Detection Methods for CVE-2026-70479
Indicators of Compromise
- Outbound requests from the Open WebUI backend to link-local addresses such as 169.254.169.254, loopback 127.0.0.0/8, or RFC1918 ranges during web-search or RAG operations.
- Playwright browser process activity issuing sub-resource fetches to non-public IP ranges shortly after ingesting a user-supplied URL.
- RAG or web-search responses containing content resembling cloud metadata (iam/security-credentials), internal admin endpoints, or Kubernetes API responses.
Detection Strategies
- Inspect Open WebUI application logs for validate_url exceptions correlated with user-submitted URLs and the Playwright loader.
- Egress-filter or log DNS resolutions from the Open WebUI host to internal-only hostnames, and alert on unexpected private-range destinations.
- Baseline normal outbound destinations for the Open WebUI service account and alert on deviations, particularly to metadata and management interfaces.
Monitoring Recommendations
- Enable network telemetry on the container or host running Open WebUI and forward flow data to a SIEM for private-range destination analysis.
- Monitor for authenticated Open WebUI users submitting URLs immediately followed by anomalous internal traffic from the backend.
- Track version banners across Open WebUI deployments to identify hosts still running 0.9.6 through 0.10.x with Playwright enabled.
How to Mitigate CVE-2026-70479
Immediate Actions Required
- Upgrade Open WebUI to version 0.11.0 or later, which contains the fix in backend/open_webui/retrieval/web/utils.py.
- If upgrading is not immediately possible, switch WEB_LOADER_ENGINE away from playwright to a loader that does not execute sub-resource JavaScript.
- Restrict egress from the Open WebUI host to only the public destinations required for web-search and model APIs.
Patch Information
The fix is delivered in Open WebUI 0.11.0. See the GitHub Security Advisory GHSA-w2rx-84hp-gg95, the Open WebUI 0.11.0 release notes, and the pull request discussion for details.
Workarounds
- Set WEB_LOADER_ENGINE to a non-Playwright value until the upgrade is applied.
- Deploy Open WebUI behind an egress proxy that blocks link-local, loopback, and RFC1918 destinations.
- Disable web-search and RAG URL ingestion for untrusted or low-trust user roles.
# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:v0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
-e WEB_LOADER_ENGINE=safe_web \
-p 3000:8080 \
ghcr.io/open-webui/open-webui:v0.11.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
