CVE-2026-87996

high

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.

Vendor / product: Openwebui — open webui

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.

CVSS

7.7

7.7 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-09-09 22:18

Modified: 2026-09-16 15:14

NVD status: Analyzed

Last synced 1 day ago

Verified against the source API 2026-10-27 06:52 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

openwebui / open_webui ≥0.9.6 <0.11.1

Weakness classification (CWE)

CWE-367 CWE-918

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r

Patch / mitigation: https://github.com/open-webui/open-webui/commit/27402ff210bfa253445720920dfb86b15a00327b

Patch / mitigation: https://github.com/open-webui/open-webui/pull/28634

References

https://github.com/open-webui/open-webui/commit/27402ff210bfa253445720920dfb86b15a00327b security-advisories@github.com
https://github.com/open-webui/open-webui/pull/28634 security-advisories@github.com
https://github.com/open-webui/open-webui/releases/tag/v0.11.1 security-advisories@github.com
https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r security-advisories@github.com
https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:52 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-87996

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs