CVE-2026-87996: Open WebUI DNS rebinding SSRF exposes

CISO Take

Open WebUI's SafePlaywrightURLLoader validates a user-supplied hostname in Python but lets the Playwright browser re-resolve that same hostname when it actually fetches the page, so an authenticated attacker who controls authoritative DNS for a domain can hand back a safe public IP to the validator and an internal or cloud-metadata IP to the browser. With PR:L, no user interaction, and CVSS 7.7, this is a low-bar SSRF that turns the web search / URL ingestion feature into a pivot into internal networks and cloud metadata endpoints (e.g. AWS/GCP/Azure instance credentials). There's no known public exploit or Nuclei template yet and it isn't in CISA KEV, but the technique (DNS rebinding TOCTOU) is well documented and trivial to automate once an attacker controls a domain's DNS. Open WebUI has three tracked downstream dependents and 168 other CVEs recorded in this package, underscoring a pattern of security debt worth factoring into deployment risk. Patch to 0.11.1 immediately; until then, restrict who can hold non-admin accounts capable of triggering web search/URL ingestion, and block outbound requests from the Open WebUI host to RFC1918 ranges and the 169.254.169.254 metadata address at the network/egress layer regardless of app-level validation.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Exploitability is high for an attacker who already holds a low-privileged authenticated account and controls a domain's DNS records — no user interaction and low attack complexity are required, and TOCTOU/DNS-rebinding SSRF is a mature, well-understood technique with existing public tooling outside this specific CVE. Impact is confidentiality-only (C:H/I:N/A:N) but severe in an AI-deployment context: SSRF into cloud metadata services can yield IAM/service credentials, and SSRF into internal services can expose admin panels, databases, or other AI infrastructure not meant to be internet-reachable. No public PoC, Nuclei template, or KEV listing currently exists, and EPSS data is unavailable, which lowers near-term mass-exploitation likelihood but does not reduce risk for any organization exposing Open WebUI with self-service account creation or shared/low-trust user pools.

How does the attack unfold?

Infrastructure setup

Attacker obtains a low-privileged Open WebUI account and sets up a domain with authoritative DNS they control.

AML.T0008.002

Validation bypass

Attacker submits the malicious hostname via web search or URL ingestion; DNS answers with a public IP so the Python-side validation check passes.

AML.T0049

DNS rebind at fetch time

Attacker flips the DNS record to an internal or cloud-metadata IP just before Playwright resolves and fetches the URL, exploiting the TOCTOU gap.

Data exposure

Playwright renders the internal/metadata response and Open WebUI returns it through the retrieval pipeline, leaking internal service data or cloud credentials to the attacker.

AML.T0075

Infrastructure setup

Attacker obtains a low-privileged Open WebUI account and sets up a domain with authoritative DNS they control.

AML.T0008.002

Validation bypass

Attacker submits the malicious hostname via web search or URL ingestion; DNS answers with a public IP so the Python-side validation check passes.

AML.T0049

DNS rebind at fetch time

Attacker flips the DNS record to an internal or cloud-metadata IP just before Playwright resolves and fetches the URL, exploiting the TOCTOU gap.

Data exposure

Playwright renders the internal/metadata response and Open WebUI returns it through the retrieval pipeline, leaking internal service data or cloud credentials to the attacker.

AML.T0075

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.9.6, < 0.11.1	`0.11.1`
151.8K 3 dependents Pushed 7d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I None

A None

What should I do?

1 step

1) Upgrade to Open WebUI >= 0.11.1 immediately, which fixes the TOCTOU gap between hostname validation and browser resolution. 2) Until patched, disable or restrict web search / URL ingestion for non-trusted/non-admin users. 3) Enforce network-layer egress controls independent of the app: block the Playwright/browser container from reaching RFC1918 ranges, link-local addresses (169.254.169.254), and other internal-only subnets via firewall/security-group rules — do not rely solely on application-level hostname checks, since this CVE is exactly a case where that check was insufficient. 4) If using cloud metadata services, prefer IMDSv2 (session-token-bound) over IMDSv1 to blunt SSRF-based credential theft. 5) Monitor logs for anomalous outbound requests from the Open WebUI/Playwright host to internal IP ranges or metadata endpoints as a detection signal.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass RAG Plugin AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application AML.T0075 - Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM07 - Insecure Plugin/Tool Design

Frequently Asked Questions

What is CVE-2026-87996?

Open WebUI's SafePlaywrightURLLoader validates a user-supplied hostname in Python but lets the Playwright browser re-resolve that same hostname when it actually fetches the page, so an authenticated attacker who controls authoritative DNS for a domain can hand back a safe public IP to the validator and an internal or cloud-metadata IP to the browser. With PR:L, no user interaction, and CVSS 7.7, this is a low-bar SSRF that turns the web search / URL ingestion feature into a pivot into internal networks and cloud metadata endpoints (e.g. AWS/GCP/Azure instance credentials). There's no known public exploit or Nuclei template yet and it isn't in CISA KEV, but the technique (DNS rebinding TOCTOU) is well documented and trivial to automate once an attacker controls a domain's DNS. Open WebUI has three tracked downstream dependents and 168 other CVEs recorded in this package, underscoring a pattern of security debt worth factoring into deployment risk. Patch to 0.11.1 immediately; until then, restrict who can hold non-admin accounts capable of triggering web search/URL ingestion, and block outbound requests from the Open WebUI host to RFC1918 ranges and the 169.254.169.254 metadata address at the network/egress layer regardless of app-level validation.

Is CVE-2026-87996 actively exploited?

No confirmed active exploitation of CVE-2026-87996 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87996?

1) Upgrade to Open WebUI >= 0.11.1 immediately, which fixes the TOCTOU gap between hostname validation and browser resolution. 2) Until patched, disable or restrict web search / URL ingestion for non-trusted/non-admin users. 3) Enforce network-layer egress controls independent of the app: block the Playwright/browser container from reaching RFC1918 ranges, link-local addresses (169.254.169.254), and other internal-only subnets via firewall/security-group rules — do not rely solely on application-level hostname checks, since this CVE is exactly a case where that check was insufficient. 4) If using cloud metadata services, prefer IMDSv2 (session-token-bound) over IMDSv1 to blunt SSRF-based credential theft. 5) Monitor logs for anomalous outbound requests from the Open WebUI/Playwright host to internal IP ranges or metadata endpoints as a detection signal.

What systems are affected by CVE-2026-87996?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, web-based retrieval/ingestion, self-hosted AI platforms.

What is the CVSS score for CVE-2026-87996?

CVE-2026-87996 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesweb-based retrieval/ingestionself-hosted AI platforms

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0049 Exploit Public-Facing Application

AML.T0075 Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.

Exploitation Scenario

An attacker registers or controls a domain (e.g. evil-domain.com) with authoritative DNS they can update in real time. They create a low-privileged Open WebUI account and trigger the web search or 'ingest URL' feature pointing at http://evil-domain.com. At validation time, their DNS server answers with a public, non-restricted IP, passing Open WebUI's Python-side hostname check. Milliseconds later, when the Playwright browser process actually performs the DNS lookup to fetch the page, the attacker's DNS server flips the A record to an internal address (e.g. a Kubernetes-internal admin API) or the cloud metadata IP 169.254.169.254. Playwright renders and returns that internal response, which flows back through Open WebUI's retrieval pipeline into the chat/RAG context — leaking internal service data or cloud IAM credentials to the attacker without ever needing direct network access to the internal target.

Weaknesses (CWE)

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition CWE-918 Server-Side Request Forgery (SSRF)

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.