PT-2026-67838 · Unknown · Open-Webui

CVE-2026-70485

·

Published

2026-08-04

·

Updated

2026-08-10

CVSS v3.1

7.1

High

VectorAV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.10.0
Description Open WebUI fails to properly validate user-supplied URLs when checking if a destination is globally routable. The system applies ipaddress.is global to literal IPv6 addresses but does not examine IPv4 addresses embedded in transition encodings. On deployments using a NAT64 gateway (a mechanism that allows IPv6-only clients to communicate with IPv4 servers), an authenticated user can wrap an internal or cloud-metadata IPv4 address within the NAT64 well-known prefix. This allows the request to bypass filters and retrieve internal response bodies through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval.
Technical details include:
  • API Endpoint: /api/v1/retrieval/process/web
  • Vulnerable Functions: validate url(), ssrf safe new conn(), and SSRFSafeResolver located in backend/open webui/retrieval/web/utils.py
This issue can lead to the exposure of cloud instance metadata, including IAM role credentials, loopback-bound admin surfaces, and internal APIs within the same VPC or cluster.
Recommendations Update Open WebUI to version 0.11.0.

Exploit

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-70485
GHSA-8X5V-CPV7-8JJP
PYSEC-2026-3645

Affected Products

Open-Webui