Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-09T22:18:47.857Z",
  "pubdate": "2026-09-09T22:18:47.857Z",
  "executiveSummary": "Open WebUI is susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to a Time-of-Check Time-of-Use (TOCTOU) flaw during URL resolution.\nThe vulnerability resides within the SafePlaywrightURLLoader component, which fails to enforce consistent hostname validation across the initial validation check and the subsequent Playwright browser request.\nBy manipulating DNS resolution, an authenticated attacker can bypass security filters to access internal network services or sensitive cloud metadata endpoints.\nThe impact includes unauthorized information disclosure and potential interaction with internal APIs, effectively turning the self-hosted platform into a proxy for internal network reconnaissance.\nExploitation requires an authenticated user session and the ability to control an authoritative DNS server to facilitate the rebinding attack.",
  "technicalDetails": "The vulnerability originates in backend/open_webui/retrieval/web/utils.py within the SafePlaywrightURLLoader class. The implementation performs a two-stage hostname validation process that is decoupled from the final resource fetching mechanism.\nIn the first stage, the application performs a programmatic check on the user-provided hostname. If the validation passes, the URL is passed to the Playwright browser instance for document rendering or content extraction.\nThe root cause is a race condition or state-inconsistency known as DNS Rebinding. Because the validation logic and the Playwright browser's network stack perform independent DNS resolutions, the application is vulnerable to an attacker-controlled DNS server.\nThe attack flow proceeds as follows: First, the attacker provides a hostname under their control that resolves to a public, non-sensitive IP address during the application's initial validation phase. This allows the URL to clear the security filter.\nSecond, when the Playwright browser processes the same URL, the attacker's DNS server returns a Time-to-Live (TTL) of zero or a short interval, prompting the browser to perform a new DNS lookup. In this second lookup, the DNS server returns an internal IP address (e.g., 127.0.0.1 or cloud metadata IP 169.254.169.254).\nBecause the Playwright browser respects the second, malicious resolution, the request is routed to internal resources that were previously gated by the validation logic. This allows the attacker to bypass access controls, interacting with internal services or leaking sensitive metadata through the platform's retrieval functionality.\nThe vulnerable component is identified as SafePlaywrightURLLoader, affecting Open WebUI versions 0.9.6 through 0.11.1. The flaw persists regardless of the synchronization mode, as both sync and async request interceptors in Playwright fail to maintain the state of the initial validation.\nPost-exploitation, the attacker may capture internal service responses, sensitive headers, or local application data, significantly undermining the security boundary of the self-hosted infrastructure."
}