CVE-2026-70485: Open WebUI SSRF Vulnerability

CVE-2026-70485 Overview

Open WebUI, a self-hosted AI platform, contains a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in versions 0.9.0 through 0.11.0. The platform validated URL destinations by applying ipaddress.is_global to literal IPv6 addresses without inspecting IPv4 addresses embedded in transition encodings. Attackers on deployments behind a NAT64 gateway can wrap internal or cloud-metadata IPv4 addresses in the NAT64 well-known prefix to bypass the filter. The malformed request reaches internal endpoints through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval. Version 0.11.0 remediates the issue.

Critical Impact
Authenticated users can retrieve internal-network responses and cloud instance metadata by encoding IPv4 targets inside IPv6 NAT64 addresses.

Affected Products

Open WebUI version 0.9.0 through versions prior to 0.11.0
Deployments operating behind a NAT64 gateway
Instances exposing RAG URL ingestion, URL-to-markdown, or web-search retrieval

Discovery Timeline

2026-08-04 - CVE-2026-70485 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70485

Vulnerability Analysis

Open WebUI attempts to prevent SSRF by rejecting destinations that resolve to non-globally-routable addresses. The pre-patch check applies ipaddress.is_global to the parsed IPv6 literal but does not decode IPv4 addresses embedded through IPv6 transition mechanisms. NAT64 gateways translate IPv6 packets targeting the well-known prefix 64:ff9b::/96 into IPv4 traffic toward the embedded destination. An attacker submits a URL such as http://[64:ff9b::a9fe:a9fe]/latest/meta-data/ where the trailing 32 bits encode 169.254.169.254. The literal IPv6 address is globally routable, so the filter passes, yet the outbound request is translated to the internal AWS metadata endpoint.

Root Cause

The check ignored embedded IPv4 semantics in IPv4-mapped, 6to4, Teredo, IPv4-compatible, and NAT64 (64:ff9b::/96 and 64:ff9b:1::/48) address formats. The is_global property on the wrapper IPv6 address does not propagate to the embedded IPv4 target.

Attack Vector

A verified user submits a crafted URL through any Open WebUI feature that fetches remote content on the server's behalf. Retrieval components include RAG ingestion, URL-to-markdown conversion, and web-search content readers. The server issues an outbound request; the NAT64 gateway rewrites it toward the embedded IPv4 destination and returns the response body to the attacker.

python

     return ipv4_addresses, ipv6_addresses
 
 
+def _is_global_addr(ip: str) -> bool:
+    addr = ipaddress.ip_address(ip)
+    if not addr.is_global:
+        return False
+    if not isinstance(addr, ipaddress.IPv6Address):
+        return True
+
+    embedded = []
+    if addr.ipv4_mapped:
+        embedded.append(addr.ipv4_mapped)
+    if addr.sixtofour:
+        embedded.append(addr.sixtofour)
+    if addr.teredo:
+        embedded.extend(addr.teredo)
+
+    b = addr.packed
+    if b[:12] == b"\\x00" * 12:
+        embedded.append(ipaddress.IPv4Address(b[12:]))
+    elif b[:12] == b"\\x00\\x64\\xff\\x9b" + b"\\x00" * 8:
+        embedded.append(ipaddress.IPv4Address(b[12:]))
+    elif b[:6] == b"\\x00\\x64\\xff\\x9b\\x00\\x01":
+        if b[8] != 0:
+            return False
+        embedded.append(ipaddress.IPv4Address(bytes((b[6], b[7], b[9], b[10]))))
+
+    return all(ip.is_global for ip in embedded)
+

Source: GitHub Commit 1717b493. The patch introduces _is_global_addr, which extracts every embedded IPv4 address from IPv6 transition encodings and requires each to be globally routable before accepting the destination.

Detection Methods for CVE-2026-70485

Indicators of Compromise

Outbound requests from Open WebUI hosts to IPv6 literals in the 64:ff9b::/96 or 64:ff9b:1::/48 ranges
URLs submitted to RAG, URL-to-markdown, or web-search endpoints containing IPv4-mapped, 6to4, or Teredo IPv6 literals
Successful HTTP fetches whose translated destination corresponds to link-local, RFC1918, or cloud-metadata addresses such as 169.254.169.254

Detection Strategies

Inspect Open WebUI application logs for user-submitted URLs containing bracketed IPv6 literals with embedded IPv4 octets
Correlate outbound proxy or firewall logs for the NAT64 well-known prefix originating from AI-platform workloads
Flag responses that include cloud-metadata JSON schemas (iam/security-credentials, instance-identity) returned to Open WebUI backend processes

Monitoring Recommendations

Alert on any egress traffic from Open WebUI containers to 169.254.169.254, fd00::/8, or RFC1918 destinations
Baseline retrieval component request rates and alert on spikes tied to a single authenticated identity
Retain URL parameters submitted to /api/v1/retrieval/* endpoints for post-incident review

How to Mitigate CVE-2026-70485

Immediate Actions Required

Upgrade Open WebUI to version 0.11.0 or later, which contains the _is_global_addr fix
Audit user accounts and revoke retrieval privileges for untrusted or dormant users
Review historical logs for URL submissions containing 64:ff9b:: or other IPv6 transition prefixes

Patch Information

The fix is delivered in Open WebUI v0.11.0 via commit 1717b493. Additional context is available in GHSA-8x5v-cpv7-8jjp.

Workarounds

Block outbound traffic from Open WebUI hosts to the NAT64 well-known prefixes 64:ff9b::/96 and 64:ff9b:1::/48 at the network layer
Restrict Open WebUI egress to an allow-list of external hostnames using a forward proxy
Disable RAG URL ingestion, URL-to-markdown conversion, and web-search retrieval features until upgrade is complete
Deny access to cloud instance-metadata endpoints from the workload's network namespace, for example via IMDSv2 enforcement on AWS

bash

# Example iptables rule blocking NAT64 well-known prefix egress
ip6tables -A OUTPUT -d 64:ff9b::/96 -j DROP
ip6tables -A OUTPUT -d 64:ff9b:1::/48 -j DROP

# Example AWS IMDSv2 enforcement
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled