CVE-2026-87996: Open WebUI Information Disclosure Vulnerability

CVE-2026-87996 Overview

CVE-2026-87996 is a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI, a self-hosted AI platform. The flaw affects the SafePlaywrightURLLoader component in backend/open_webui/retrieval/web/utils.py. It exists in versions 0.9.6 through 0.11.0 and is fixed in version 0.11.1. The vulnerability is classified as a Time-of-Check Time-of-Use (TOCTOU) issue [CWE-367]. Authenticated users controlling authoritative DNS can bypass hostname validation to reach internal services or cloud metadata endpoints through web search or URL ingestion features.

Critical Impact
An authenticated attacker with control of a DNS record can exfiltrate responses from internal-only services and cloud instance metadata endpoints, disclosing credentials and internal network topology.

Affected Products

Open WebUI versions 0.9.6 through 0.11.0
SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py
Deployments exposing web search or URL ingestion features to authenticated users

Discovery Timeline

2026-09-09 - CVE-2026-87996 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87996

Vulnerability Analysis

Open WebUI's SafePlaywrightURLLoader implements a two-step process when ingesting user-supplied URLs. The Python backend first validates the hostname to block private IP addresses, non-HTTP schemes, and filter-listed hosts. The Playwright browser then independently resolves the hostname again inside the sync and async request interceptors before issuing the request.

This dual resolution creates a classic DNS rebinding window. The attacker's authoritative DNS server returns a public IP address during Python validation. It returns an internal address such as 127.0.0.1, 169.254.169.254, or an RFC 1918 range when Playwright resolves it seconds later. The response from the internal service flows back through the loader to the authenticated user.

The issue only requires low-privilege authenticated access. Because the browser fetches the resource server-side, the attacker crosses trust boundaries into the Open WebUI host's network segment, including cloud metadata services on AWS, Azure, and GCP.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race between Python-side hostname validation and Playwright's independent DNS resolution. The validate_url function verifies one resolution result, but the browser performs a separate lookup that the validation never observes.

Attack Vector

The attacker registers a domain and configures short TTL DNS records on an authoritative server they control. They submit that domain to Open WebUI through the web search or URL ingestion feature. Validation resolves the hostname to a public IP and passes. Playwright then re-resolves and receives an internal target such as the cloud metadata endpoint. The browser retrieves the metadata response and returns it through the loader interface.

python

# Security patch in backend/open_webui/retrieval/utils.py (excerpt)
def _get_content_from_url_sync(request, url: str, loader_config):
-    from open_webui.retrieval.web.utils import validate_url, _SSRFSafeAdapter
+    from open_webui.retrieval.web.utils import validate_url, get_ssrf_safe_requests_session

    # Validate URL before making any request (blocks private IPs, non-HTTP, filter list)
    validate_url(url)

Source: GitHub Commit 27402ff. The patch routes Playwright web loader requests through a shared SSRF-safe HTTP client session, eliminating the independent resolution path that enabled the rebinding attack.

Detection Methods for CVE-2026-87996

Indicators of Compromise

Outbound DNS queries from Open WebUI hosts to attacker-controlled domains with unusually short TTL values
Server-side HTTP requests to 169.254.169.254, metadata.google.internal, or 169.254.169.254/latest/meta-data/ originating from the Open WebUI process
URL ingestion or web search entries containing external domains that later map to internal or link-local addresses in host logs

Detection Strategies

Correlate Open WebUI application logs with DNS resolver logs to flag hostnames that resolve differently within short time windows
Alert on any egress from Open WebUI containers or hosts to RFC 1918, loopback, or link-local ranges
Baseline the destinations reached by Playwright browser processes and alert on deviations toward cloud metadata endpoints

Monitoring Recommendations

Enable verbose logging for the retrieval and web loader modules and forward events to a centralized SIEM
Instrument the Open WebUI host with egress firewall rules that drop traffic to metadata IPs and log the drops for review
Monitor authentication events for accounts that repeatedly submit URLs referencing newly registered or low-reputation domains

How to Mitigate CVE-2026-87996

Immediate Actions Required

Upgrade Open WebUI to version 0.11.1 or later on all deployments
Restrict outbound network access from Open WebUI hosts to cloud metadata endpoints and internal management networks
Audit authenticated user accounts and revoke sessions for accounts that submitted suspicious URLs

Patch Information

The fix is delivered in Open WebUI v0.11.1 via Pull Request #28634 and commit 27402ff. The patch routes Playwright web loader requests through the shared SSRF-safe HTTP client session used elsewhere in the retrieval pipeline. Full details are available in GitHub Security Advisory GHSA-4v28-j6q3-5m4r.

Workarounds

Disable the web search and URL ingestion features until the upgrade is deployed
Deploy an egress proxy that enforces IP allowlists and blocks resolution to private, loopback, and link-local ranges
On AWS instances, enforce IMDSv2 and require session tokens to prevent metadata theft via SSRF

bash

# Example iptables egress rules to block metadata and private ranges from the Open WebUI host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP