CVE-2026-87996

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.11.0

Description An issue exists in the SafePlaywrightURLLoader component within backend/open webui/retrieval/web/utils.py affecting both sync and async request interceptors. The system validates a user-controlled hostname in Python but allows the Playwright browser to resolve the hostname a second time when performing the request. An authenticated user with control over the authoritative DNS can provide a public address during the initial validation and an internal address during the browser resolution. This DNS rebinding allows the browser to connect to restricted internal services or cloud instance metadata (such as IMDSv1), exposing sensitive responses through web search or URL ingestion. This occurs when the WEB LOADER ENGINE variable is set to playwright and a reachable Playwright browser is configured via PLAYWRIGHT WS URL or locally.

Recommendations Update Open WebUI to version 0.11.1. As a temporary mitigation, avoid setting the WEB LOADER ENGINE variable to playwright to disable the affected loader engine.