Executive brief
Open WebUI, an interface for interacting with large language models, contains a flaw in its web-browsing feature. When configured to use the Playwright engine to fetch web content, the system fails to properly restrict where the browser can go after the initial page is loaded. This allows an authenticated user to trick the system into reading sensitive data from internal services, such as cloud metadata or private APIs, and displaying that information back to the user.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the SafePlaywrightURLLoader component of Open WebUI. The request interceptor in backend/open_webui/retrieval/web/utils.py was designed to validate only 'document' resource types, allowing all other sub-resource requests (scripts, images, XHR) to bypass address validation. An authenticated attacker can submit a URL that uses JavaScript to fetch sensitive data from internal IP addresses (e.g., 169.254.169.254) or private network services. Because the loader returns the final DOM to the user for RAG or search purposes, this acts as a non-blind SSRF read primitive. The issue is fixed in version 0.11.0 by enforcing validation on all intercepted requests and blocking service workers and WebSockets.
Affected products
- Open WebUI open-webui >= 0.9.6, < 0.11.0
Timeline
- 2026-08-02: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched: Fixed in version 0.11.0