Junglewise Threat Intelligence

CVE-2026-87996: Open WebUI SSRF via DNS rebinding in Playwright web loader

CVE-2026-87996 · Severity: high · CVSS 7.7 · Published 2026-09-10

Executive brief

Open WebUI is an AI application platform that includes a web loader component for ingesting content from URLs. When the optional Playwright engine is enabled, an authenticated user can exploit a DNS rebinding vulnerability to force the application to fetch content from internal services (like cloud metadata endpoints or internal APIs) that should be unreachable. By controlling DNS responses, an attacker can bypass the application's security checks and retrieve sensitive data like cloud credentials. This only affects deployments using the Playwright web loader option, not the default configuration.

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) via DNS rebinding in the SafePlaywrightURLLoader component. The vulnerable code path performs hostname validation in Python (resolving once and checking the result), then delegates the actual HTTP request to the Playwright browser, which independently resolves the hostname a second time with no connection-layer pinning. An attacker with control of authoritative DNS can answer the validation query with a public address and the browser's query with an internal address (e.g., 169.254.169.254 for cloud metadata). The browser connects to the attacker-controlled internal address while the security check remains satisfied. Requires WEB_LOADER_ENGINE=playwright, network reachability to the browser, authenticated user privileges, and network routes from the browser to internal services. Fixed in 0.11.1 by making the interceptor issue requests through the SSRF-safe HTTP client, resolving once and pinning the connection.

Affected products

  • Open WebUI open-webui >= 0.9.6, < 0.11.1

Timeline

  • 2026-09-10: disclosed: GitHub Advisory published
  • 2026-09-10: patched: Fixed in version 0.11.1 via commit 27402ff21

References

Related threats