CVE-2026-70479

Executive Summary

CVE-2026-70479 is a server-side request forgery (SSRF) vulnerability in Open WebUI, a self-hosted AI platform, affecting versions 0.9.6 through 0.11.0 when the WEB_LOADER_ENGINE=playwright configuration option is enabled. An authenticated attacker can craft a malicious web page that, when processed by the Playwright loader, uses client-side JavaScript to make requests to blocked internal addresses — such as cloud metadata services or internal infrastructure — and exfiltrate the response data through web-search or RAG (Retrieval-Augmented Generation) output. The vulnerability is remediated in version 0.11.0, and given the authentication requirement combined with network-based attack vector and high confidentiality impact, it carries a CVSS score of 7.7.

Technical Analysis

The root cause of CVE-2026-70479 resides in the Playwright-based web loader component of Open WebUI. When WEB_LOADER_ENGINE=playwright is set, the loader leverages a headless Chromium browser instance to fetch user-supplied URLs for content ingestion into web-search or RAG pipelines. The security boundary enforcement is flawed: the loader validates only the top-level page request against an allowlist/denylist of blocked internal addresses (RFC 1918 ranges, link-local, metadata endpoints such as 169.254.169.254, etc.). It fails to enforce the same validation on sub-resource requests initiated by the page's JavaScript.

Attack surface details:

• Precondition: The WEB_LOADER_ENGINE environment variable must explicitly be set to playwright. The default engine (if any other) does not exhibit this behavior.
• Authentication: An account with access to the web-search or RAG ingestion features is required (CVSS PR:L).
• Mechanism: A page loaded by Playwright executes arbitrary JavaScript within the headless browser context. Sub-resource requests (XHR/fetch, WebSocket, image src, iframe, etc.) are not subject to the internal-address validation applied to the initial navigation.
• Data exfiltration: The DOM resulting from the page execution — including content fetched from internal addresses — is returned to the Open WebUI backend and subsequently embedded in search results or RAG-generated responses, which the authenticated user can read.

The vulnerability is rooted in a validation-order flaw: the security check is applied at the navigation layer (top-level request) rather than at the network layer (all outbound requests from the browser context). This is a classic SSRF pattern where the enforcing component (URL validator) and the executing component (headless browser) are decoupled, allowing the browser to bypass the policy.

The affected version range — 0.9.6 up to (but excluding) 0.11.0 — indicates that the flawed validation logic was introduced in 0.9.6 and corrected in 0.11.0. The specific code change responsible for the fix is not yet independently confirmed (patch confidence 2/4), but the NVD advisory identifies 0.11.0 as the patched release.

Exploitation Scenarios

No public exploit code or PoC has been disclosed at the time of this report; however, the vulnerability mechanism is well-defined by the advisory. A skilled attacker can construct a reliable exploit chain as follows:

1. Reconnaissance and target identification: The attacker authenticates to the Open WebUI instance with a low-privilege account. They confirm the instance is running version 0.9.6–0.10.x and that the Playwright loader is enabled by submitting a benign URL to the web-search feature and observing the fetching behavior. Concurrently, they fingerprint the internal network by attempting to infer 10.x, 172.16.x, or 192.168.x address spaces commonly used in the deployment environment.

2. Weaponization and trigger: The attacker hosts a malicious HTML page on an externally accessible server they control. The page contains JavaScript that performs the following sequence:

   • Triggers a series of fetch() or XMLHttpRequest calls to candidate internal IPv4 addresses (e.g., http://10.0.0.1/, http://192.168.1.1/, http://169.254.169.254/latest/meta-data/).
   • For each successful response, captures the response body and writes it into the DOM, e.g., by setting document.body.innerHTML = responseData or by populating meta tags.
   • Optionally iterates through common ports (80, 443, 8080, 9200, 6379, 3306) on discovered hosts.
   • The page finishes loading, and Playwright serializes the DOM — including the embedded internal-fetched content — and returns it to Open WebUI.

3. Execution and data retrieval: The attacker submits the malicious URL to the web-search or RAG ingestion endpoint. Open WebUI's Playwright loader navigates to the top-level page (which passes validation because the external domain is allowed), executes the JavaScript, and returns the mutated DOM. The search index or RAG knowledge base now contains the internal data exfiltrated by the script.

4. Post-exploitation impact: The attacker queries the search engine or RAG interface with crafted prompts to extract the exfiltrated data from the ingestion results. Depending on the internal addresses reached, they may obtain:

   • Cloud instance metadata (IAM credentials, security group configurations) from 169.254.169.254.
   • Internal API responses, database error messages, or configuration files from reachable services.
   • A foothold for lateral movement if internal credentials or endpoints are disclosed.

Because the attack requires only a single low-privilege authenticated user and the Playwright engine, it can be executed repeatedly to enumerate the internal network and harvest sensitive data without triggering external egress filtering — the requests originate from within the Open WebUI server itself.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N scores 7.7 (High), reflecting:

• Attack Vector (AV:N): Exploitable over the network; no physical or adjacent access required.
• Attack Complexity (AC:L): The knowledge required to craft a malicious page is low; no race conditions or special conditions beyond the Playwright engine being enabled.
• Privileges Required (PR:L): Authenticated low-privilege user; no admin rights needed.
• User Interaction (UI:N): No victim interaction beyond the automated loader; the attacker fully controls the malicious page.
• Scope (S:C): The compromised component (headless browser) and the impacted security domain (internal network) are distinct, indicating scope change.
• Confidentiality Impact (C:H): Full disclosure of internal data reachable by HTTP; integrity and availability are unaffected (I:N, A:N).

Business impact is significant for self-hosted AI deployments in enterprise environments where Open WebUI is integrated with internal knowledge bases, code repositories, or CI/CD systems. A successful exploitation leaks cloud metadata (potentially IAM credentials), internal API keys, or sensitive documents stored behind the perimeter, enabling account takeover or lateral movement. Blast radius extends to the entire internal network reachable from the Open WebUI host, not merely the application itself. Organizations running Open WebUI in cloud environments (AWS, GCP, Azure) face especially high risk due to the predictability of the 169.254.169.254 metadata endpoint.

Detection Guidance

Sigma Rule

title: Open WebUI SSRF via Playwright Sub-Resource Requests
id: 71e2f7a4-9c3b-4a1b-8e5d-3f1c9d2e6a44
status: experimental
description: Detects attempts to exploit CVE-2026-70479 by identifying HTTP requests to internal RFC1918 or cloud metadata addresses originating from Open WebUI processes.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-70479
tags:
    - attack.t1190
    - attack.t1007
author: valtersit.com Threat Intelligence
date: 2026/07/15
logsource:
    category: webserver
    product: openwebui
detection:
    selection_internal:
        cs-method: GET|POST
        cs-uri-stem|startswith: 
            - '/web/search'
            - '/api/rag'
        cs-uri-query|contains:
            - '10.'
            - '172.16.'
            - '192.168.'
            - '169.254.169.254'
    selection_playwright:
        cs-user-agent|contains: 'HeadlessChrome'
    condition: selection_internal and selection_playwright
level: high
falsepositives:
    - Legitimate internal URL fetching if the operator intentionally allows intranet sites in search queries

YARA Rule

rule openwebui_ssrf_playwright_payload {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects malicious HTML payloads targeting CVE-2026-70479 with SSRF via Playwright sub-resource requests"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-70479"
        date = "2026-07-15"
        severity = "high"
    strings:
        $meta_endpoint = "169.254.169.254" ascii wide nocase
        $rfc1918_10 = "http://10." ascii wide nocase
        $rfc1918_172 = "http://172.16." ascii wide nocase
        $rfc1918_192 = "http://192.168." ascii wide nocase
        $fetch_call = "fetch(" ascii wide
        $xhr_call = "XMLHttpRequest" ascii wide
        $dom_write = "document.body.innerHTML" ascii wide nocase
        $dom_write2 = "innerText" ascii wide nocase
    condition:
        uint16(0) == 0x3C3F or uint32(0) == 0x3C68746D or uint32(0) == 0x3C21444F or
        filesize < 200KB and
        1 of ($meta_endpoint, $rfc1918_*) and
        (1 of ($fetch_call, $xhr_call)) and
        (1 of ($dom_write, $dom_write2))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Open WebUI SSRF Attempt (CVE-2026-70479)"; flow:established,to_server; content:"GET"; http_method; content:"/web/search|/api/rag"; http_uri; content:"url="; http_uri; pcre:"/url\=.*(?:10\.[0-9]{1,3}\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.169\.254)/Ui"; reference:cve,2026-70479; classtype:attempted-recon; sid:270479001; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name == "chrome" and process.args contains "playwright" and process.args contains "headless"]
  [network where 
    (cidrMatch(destination.ip, "10.0.0.0/8") or
     cidrMatch(destination.ip, "172.16.0.0/12") or
     cidrMatch(destination.ip, "192.168.0.0/16") or
     destination.ip == "169.254.169.254") and
    process.name == "chrome"]

Splunk SPL Query

index=proxy sourcetype=pan:traffic OR sourcetype=cisco:asa
  (src_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) AND
   dest_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254) AND
   url IN ("*http://10.*", "*http://172.16.*", "*http://192.168.*", "*http://169.254.169.254*"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, url, user_agent
| where like(user_agent, "%Chrome%") OR like(user_agent, "%Headless%")
| sort - count

Wazuh OSSEC Rule

<group name="openwebui,">
  <rule id="270479" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(web/search|api/rag).*</field>
    <field name="url" type="pcre2">url=.*(?:10\.(?:[0-9]{1,3}\.){2}[0-9]{1,3}|172\.(?:1[6-9]|2[0-9]|3[01])\.(?:[0-9]{1,3}\.){2}[0-9]{1,3}|192\.168\.(?:[0-9]{1,3}\.){2}[0-9]{1,3}|169\.254\.169\.254)</field>
    <description>Open WebUI SSRF attempt detected (CVE-2026-70479) - internal address in search/rag URL</description>
    <group>web_application_attack,ssrf,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — single source (NVD) claims patch in version 0.11.0; not yet independently confirmed.

1. Immediate mitigations:

   • Disable the Playwright loader by setting WEB_LOADER_ENGINE to an alternative supported engine (e.g., trafilatura or requests) if those are available in the deployment. If no alternative is viable, disable web-search and RAG ingestion features entirely until patching.
   • If the Playwright engine must remain active, implement an egress firewall or network policy that blocks outbound HTTP/HTTPS traffic from the Open WebUI host to RFC 1918 address space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and loopback (127.0.0.0/8), including the cloud metadata IP 169.254.169.254. This provides a defense-in-depth layer that prevents data exfiltration even if the browser bypasses application-level validation.
   • Restrict which users have access to web-search and RAG functionalities; only grant this to trusted personnel who require it, reducing the pool of potential attackers.

2. Patch/upgrade steps:

   • Upgrading to Open WebUI 0.11.0 or later is the definitive fix. Use the project's official upgrade instructions (e.g., pip install --upgrade open-webui for Python-based installations, or redeploying the Docker image ghcr.io/open-webui/open-webui:latest for containerized deployments). Verify the running version post-upgrade with open-webui --version or equivalent status page.
   • Because the patch is only claimed by NVD and not independently confirmed, perform regression testing on the web-search and RAG features after upgrading to validate that the SSRF validation now covers sub-resource requests. Monitor community channels or the Open WebUI GitHub repository for confirmation and any hotfixes.

3. Long-term hardening:

   • Run Open WebUI in an isolated network segment (DMZ or dedicated VLAN) with strict micro-segmentation, ensuring the host can only reach required external services and not the full internal network.
   • Implement a web application firewall (WAF) with an outbound SSRF protection rule set that inspects URLs in POST bodies for internal address patterns, complementing the application fix.
   • Audit all self-hosted AI platforms and similar browser-based loading tools for the same class of SSRF flaws; the validation-order pattern (validating top-level requests but not sub-resources) is a recurring flaw in headless browser integrations.
   • Subscribe to Open WebUI security advisories and monitor CVE feeds to detect any regressions or incomplete fixes in future releases.

References

• NVD Entry — CVE-2026-70479: https://nvd.nist.gov/vuln/detail/CVE-2026-70479
• Open WebUI Official Release 0.11.0 (patch version): https://github.com/open-webui/open-webui/releases/tag/v0.11.0
• Open WebUI GitHub Repository (config documentation, WEB_LOADER_ENGINE): https://github.com/open-webui/open-webui
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-918 — Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html

No known threat actor campaigns or exploitation-in-the-wild evidence has been reported for CVE-2026-70479 as of this writing. The CVE has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public PoC, exploit code, or Nuclei template has been disclosed. However, SSRF weaknesses in self-hosted AI tooling have historically been targeted by both commodity botnets and APT groups, so proactive patching is strongly recommended despite the absence of current exploitation reports.