CVE-2026-87996

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.

• CWE-367
• CWE-918

• https://github.com/open-webui/open-webui/commit/27402ff210bfa253445720920dfb86b15a00327b
• https://github.com/open-webui/open-webui/pull/28634
• https://github.com/open-webui/open-webui/releases/tag/v0.11.1
• https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r
• https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r

Published

Sep 9, 2026

Last Modified

Sep 10, 2026

Status

Awaiting Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-87962t-digest versions 3.1 through 3.3 contain a denial of servic…7.5
• CVE-2026-8797An access control deficiency vulnerability exists in Express…8.5
• CVE-2026-8798In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3…8.7
• CVE-2026-87993The consul-template library is vulnerable to an information …7.7
• CVE-2026-87994Open WebUI is an extensible, feature-rich, and user-friendly…4.3
• CVE-2026-87995Open WebUI is an extensible, feature-rich, and user-friendly…8.7
• CVE-2026-87997Open WebUI is an extensible, feature-rich, and user-friendly…4.3
• CVE-2026-87998Open WebUI is an extensible, feature-rich, and user-friendly…7.1
• CVE-2026-87999Open WebUI is an extensible, feature-rich, and user-friendly…7.1
• CVE-2026-8800Incorrect Authorization vulnerability in Progress MOVEit Tra…8.8
• CVE-2026-88000Open WebUI is an extensible, feature-rich, and user-friendly…6.5
• CVE-2026-88001Open WebUI is an extensible, feature-rich, and user-friendly…5