CVE-2026-87996: Open WebUI SSRF via DNS rebinding in Playwright web loader

CVE-2026-87996 · Severity: high · CVSS 7.7 · Published 2026-09-09

Open WebUI is an AI application platform that includes a web loader component for ingesting content from URLs. When the optional Playwright engine is enabled, an authenticated user can exploit a DNS rebinding vulnerability to force the application to fetch content from internal services (like cloud metadata endpoints or internal APIs) that should be unreachable. By controlling DNS responses, an attacker can bypass the application's security checks and retrieve sensitive data like cloud credentials. This only affects deployments using the Playwright web loader option, not the default configuration.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-87996 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87996 being exploited in the wild.
How severe is CVE-2026-87996?
High severity, with a CVSS score of 7.7, published 9 September 2026.
Which products and versions are affected?
open-webui (PyPI) >= 0.9.6, < 0.11.1, ECOSYSTEM:introduced=0.9.6,fixed=0.11.1.
Is there a fix for CVE-2026-87996?
Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87996 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-87996?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.11.1 or later
    pip install "open-webui>=0.11.1"

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) via DNS rebinding in the SafePlaywrightURLLoader component. The vulnerable code path performs hostname validation in Python (resolving once and checking the result), then delegates the actual HTTP request to the Playwright browser, which independently resolves the hostname a second time with no connection-layer pinning. An attacker with control of authoritative DNS can answer the validation query with a public address and the browser's query with an internal address (e.g., 169.254.169.254 for cloud metadata). The browser connects to the attacker-controlled internal address while the security check remains satisfied. Requires WEB_LOADER_ENGINE=playwright, network reachability to the browser, authenticated user privileges, and network routes from the browser to internal services. Fixed in 0.11.1 by making the interceptor issue requests through the SSRF-safe HTTP client, resolving once and pinning the connection.

Affected products

  • Open WebUI open-webui >= 0.9.6, < 0.11.1

Identifiers

  • CVE-2026-87996
  • GHSA-4v28-j6q3-5m4r
  • PYSEC-2026-4120

Timeline

  • 2026-09-10: disclosed: GitHub Advisory published
  • 2026-09-10: patched: Fixed in version 0.11.1 via commit 27402ff21

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.