---
id: CVE-2026-87996
title: >-
  Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI
  platform
summary: >-
  Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI
  platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in
  backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname
  in Python and then l…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-367
  - CWE-918
vendor: openwebui
product: open_webui
affected:
  - 'open_webui >= 0.9.6, < 0.11.1'
patched:
  - open_webui 0.11.1
published: '2026-09-09'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:14:48.890'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87996'
references:
  - url: >-
      https://github.com/open-webui/open-webui/commit/27402ff210bfa253445720920dfb86b15a00327b
    label: security-advisories@github.com
  - url: 'https://github.com/open-webui/open-webui/pull/28634'
    label: security-advisories@github.com
  - url: 'https://github.com/open-webui/open-webui/releases/tag/v0.11.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87996'
  - url: 'https://github.com/open-webui/open-webui'
tags:
  - nvd
  - cve.org
  - osv
  - pip
epss: 0.00354
epssPercentile: 0.26418
aliases:
  - GHSA-4v28-j6q3-5m4r
ecosystem: pip
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T13:48:05.930434Z'
ingestedAt: '2026-09-09T22:24:01.173Z'
---

## Overview

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.

## Affected

- `open_webui >= 0.9.6, < 0.11.1`

## Remediation

Upgrade past the affected range:

- `open_webui 0.11.1`

## Package advisory (CVE-2026-87996)

Affected packages:

- `open-webui >= 0.9.6, < 0.11.1`

Patched in:

- `open-webui 0.11.1`

Source: https://osv.dev/vulnerability/GHSA-4v28-j6q3-5m4r