Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

CVE-2026-87996 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

CVE-2026-87996

Open WebUI (self-hosted AI platform), versions 0.9.6 through 0.11.1 , is affected by an SSRF via DNS rebinding in the SafePlaywrightURLLoader component (backend/open_webui/retrieval/web/utils.py). The root cause is a trust mismatch: a user-controlled hostname is validated in Python, but the Playw...

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

CVE-2026-54018

Open WebUI (self-hosted offline AI) contains SSRF protection bypass in the Playwright Web Loader prior to version 0.9.6. The validator checks only the initial URL; Playwright follows redirects (301/302) by default, allowing an attacker-supplied URL that redirects to internal addresses (e.g., loca...