CVE-2026-70485

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in transition encodings. On a deployment with a NAT64 gateway, any verified user could wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval. This issue is fixed in 0.11.0.

• CWE-918

• https://github.com/open-webui/open-webui/commit/1717b493d83c86afa82aa8bc50139250852dd2f3Patch
• https://github.com/open-webui/open-webui/releases/tag/v0.11.0Release Notes
• https://github.com/open-webui/open-webui/security/advisories/GHSA-8x5v-cpv7-8jjpExploit, Vendor Advisory
• https://github.com/open-webui/open-webui/security/advisories/GHSA-8x5v-cpv7-8jjpExploit, Vendor Advisory

Published

Aug 4, 2026

Last Modified

Sep 18, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7048The Photo Gallery by 10Web – Mobile-Friendly Image Gallery p…6.5
• CVE-2026-70480Open WebUI is an extensible, feature-rich, and user-friendly…4.1
• CVE-2026-70481Open WebUI is an extensible, feature-rich, and user-friendly…5.4
• CVE-2026-70482Open WebUI is an extensible, feature-rich, and user-friendly…8.8
• CVE-2026-70483Open WebUI is an extensible, feature-rich, and user-friendly…4.3
• CVE-2026-70484Open WebUI is an extensible, feature-rich, and user-friendly…5.4
• CVE-2026-70486Open WebUI is an extensible, feature-rich, and user-friendly…5.4
• CVE-2026-70487Open WebUI is an extensible, feature-rich, and user-friendly…6.5
• CVE-2026-70488Open WebUI is an extensible, feature-rich, and user-friendly…4.3
• CVE-2026-70489Open WebUI is an extensible, feature-rich, and user-friendly…6.5
• CVE-2026-7049The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugi…7.2
• CVE-2026-70490Open WebUI is an extensible, feature-rich, and user-friendly…6.3