CVE-2026-70479

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.9

Description When the WEB LOADER ENGINE variable is set to playwright, the Playwright web loader only validates the top-level page request, allowing sub-resource requests to pass unvalidated. An authenticated user can provide a page that uses JavaScript to access blocked internal addresses, such as cloud instance metadata, other containers on the same network, or internal APIs bound to private addresses. The returned DOM, including data read from these internal addresses, is then included in the web-search or RAG (Retrieval-Augmented Generation) output. This occurs because the SafePlaywrightURLLoader function in backend/open webui/retrieval/web/utils.py was designed to return early for any request whose resource type was not document, skipping validation for subsequent scripts and sub-resources.

Recommendations Update Open WebUI to version 0.11.0. As a temporary mitigation, avoid setting the WEB LOADER ENGINE variable to playwright.