CVE-2026-87996

Executive Summary

CVE-2026-87996 is a time-of-check-to-time-of-use (TOCTOU) vulnerability in Open WebUI's SafePlaywrightURLLoader component, caused by a DNS rebinding/validation gap: a hostname is validated in Python but re-resolved by the Playwright browser, allowing an authenticated attacker with control of authoritative DNS to bypass SSRF protections. Affected deployments are self-hosted Open WebUI instances running versions 0.9.6 through 0.11.0 that expose user-controllable web search or URL ingestion with Playwright-based retrieval enabled. Successful exploitation lets an authenticated low-privilege user read responses from internal services or cloud metadata endpoints, yielding high confidentiality impact (CVSS 7.7, Scope: Changed).

Technical Analysis

The vulnerability resides in backend/open_webui/retrieval/web/utils.py, specifically within the SafePlaywrightURLLoader class. Open WebUI is a self-hosted AI platform that lets users trigger outbound web retrieval — for example, through web search augmentation or URL ingestion features — to gather page content for model context. To prevent server-side request forgery (SSRF), the loader performs a hostname validation step in Python before the browser navigation occurs.

The core flaw is a classic TOCTOU / DNS rebinding pattern (CWE-367). The validation and the eventual connection are performed by two different resolution contexts:

1. Validation context (Python): The Python validation logic resolves the user-supplied hostname and checks the resulting address against the intended policy (i.e., reject private/reserved/internal addresses).
2. Use context (Playwright browser): After validation passes, the browser (§ either the browser process or a routed network stack) performs its own DNS resolution of the same hostname immediately before connecting, as part of its normal request pipeline (sync and async request interceptors are the code paths described).

Because the hostname, not the resolved IP, is what is forwarded from validation to the browser, the two steps are not atomically bound together — there is no pinning of the validated address to the subsequent request. An attacker who controls authoritative DNS for a domain can serve different answers across queries (a "rebinding" attack): the answer returned during Python-side validation can be a benign, public address that passes the check, while the answer returned to the Playwright browser during actual connection can be an internal address (e.g., 127.0.0.1, 169.254.169.254, or an RFC1918 address). The browser then connects to the internal target, and the response body is surfaced back through the Open WebUI retrieval pipeline to the caller via web search results or URL ingestion output.

Notably, exploitation requires an authenticated account (PR:L — low privileges) but no user interaction (UI:N), and the CVSS base vector marks S:C (Scope: Changed), reflecting that the vulnerable component (Open WebUI's loader) can affect resources beyond its original security scope (internal network services and cloud metadata). Confidentiality impact is high (C:H); integrity and availability impacts are none. No CNA title was provided, and the NVD description is the sole authoritative technical source; no public PoC, Nuclei template, or exploit code exists at the time of writing.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (TOCTOU/DNS rebinding) and the affected code paths named in the NVD description.

1) Reconnaissance / target identification The attacker identifies a reachable, self-hosted Open WebUI instance running a vulnerable version (0.9.6 through 0.11.0) and determines that Playwright-backed URL retrieval is enabled (web search or URL ingestion features that invoke SafePlaywrightURLLoader). The attacker registers an account, since authentication is required (PR:L). The attacker also needs authoritative control of a DNS domain — a prerequisite for the rebinding phase.

2) Triggering the flaw class The attacker crafts a URL using a hostname under their authoritative DNS control and submits it through the URL ingestion or web search functionality. When Open WebUI processes the URL, SafePlaywrightURLLoader performs Python-side hostname validation. Because the attacker controls DNS, the authoritative server answers this validation query with a public, policy-compliant address, so validation passes.

3) Execution / payload delivery at the vulnerability-class level Immediately afterward, when the Playwright browser (sync or async request interceptor path) resolves the same hostname to establish the connection, the attacker's DNS server returns an internal address instead — the "rebinding" step. Optionally, DNS TTLs are set to near-zero to make the switch fast and reliable. The browser connects to the internal target. This behavior is inherent to resolver manipulation; no special payload beyond the crafted hostname is required. The attacker does not need to publish exploit code — the "payload" is the DNS answer sequence itself.

4) Post-exploitation impact The browser fetches content from internal-only services or cloud metadata endpoints, and the response is returned through the retrieval pipeline as web search/ingestion output. This yields read access to internal HTTP services reachable from the Open WebUI host and to cloud instance metadata providers (e.g., the standard link-local metadata address 169.254.169.254, where reachable and unprotected). The confidentiality exposure can include service banners, internal API responses, and, in misconfigured cloud environments, credential-bearing metadata. There is no integrity or availability impact. Whether cloud metadata is reachable is environment-dependent (IMDSv2 enforcement, network policy) and is not asserted by the description beyond the general exposure class.

Impact Assessment

• Affected systems: Self-hosted Open WebUI instances in versions 0.9.6 through 0.11.0 with Playwright-based web retrieval (SafePlaywrightURLLoader) reachable by authenticated users.
• Attack prerequisites: Authenticated low-privilege account + attacker-controlled authoritative DNS. No user interaction. Network reachability to the service (AV:N).
• CVSS subscores: Attack Vector Network (N), Attack Complexity Low (L) once the DNS prerequisite is met, Privileges Required Low (L), User Interaction None (N), Scope Changed (C), Confidentiality High (H), Integrity None (N), Availability None (N) → Base 7.7.
• Blast radius: Because Scope is Changed, the vulnerable retrieval component can affect resources outside its own trust boundary — internal network services and cloud metadata. The practical impact depends heavily on the network position of the Open WebUI host: instances deployed in cloud VPCs with broad internal reachability and reachable instance metadata present the largest exposure. Exposure is bounded by read-only data leakage (C:H, no I/A), but leaked metadata credentials can be a pivot vector to broader compromise.
• EPSS: Not yet scored by FIRST.org. No exploitation evidence in CISA KEV. No known threat actor campaigns or in-the-wild exploitation per available data.

Detection Guidance

Sigma Rule

title: Open WebUI SafePlaywrightURLLoader SSRF/DNS Rebinding Attempt
id: 7c9a1e42-5b3f-4d21-9e77-2a4f6c1b8d33
status: experimental
description: Detects suspicious outbound retrieval patterns consistent with DNS rebinding/SSRF abuse of Open WebUI's SafePlaywrightURLLoader (CVE-2026-87996).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87996
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  product: linux
  service: open_webui
detection:
  selection_loader:
    message|contains:
      - 'SafePlaywrightURLLoader'
      - 'retrieval/web/utils'
  selection_ssrf:
    message|contains:
      - '169.254.169.254'
      - 'metadata.google.internal'
      - '127.0.0.1'
      - 'localhost'
  selection_rebind_indicator:
    message|contains:
      - 'hostname'
    message|contains|all:
      - 'validate'
      - 'playwright'
  condition: selection_loader and (selection_ssrf or selection_rebind_indicator)
falsepositives:
  - Legitimate administrative testing of local endpoints
level: high
tags:
  - attack.t1190
  - cve.2026-87996

YARA Rule

rule CVE_2026_87996_OpenWebUI_SafePlaywright_SSRF
{
    meta:
        description = "Detects Open WebUI retrieval/web/utils.py content referencing the vulnerable SafePlaywrightURLLoader SSRF/rebinding path"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87996"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cls  = "SafePlaywrightURLLoader" ascii wide
        $path = "retrieval/web/utils.py" ascii wide
        $f1   = "async" ascii
        $f2   = "interceptor" ascii nocase
        $meta = "169.254.169.254" ascii

    condition:
        uint16(0) == 0x7A7A or
        (
            ($cls or $path) and
            (1 of ($f1, $f2)) and
            $meta
        ) or
        (
            $cls and $path
        )
}

Suricata IDS Rule

alert dns any any -> any 53 (msg:"CVE-2026-87996 Open WebUI Possible DNS Rebinding for SSRF via SafePlaywrightURLLoader"; flow:to_server; dns.query.name; content:".|00|"; dns.rcode:0; threshold:type both, track by_src, count 5, seconds 10; metadata:affected_product Open_WebUI, cve CVE-2026-87996; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87996; classtype:attempted-recon; sid:202687996; rev:1;)

alert http any any -> any any (msg:"CVE-2026-87996 Open WebUI Retrieval to Internal/Metadata Address (Possible SSRF)"; flow:to_server,established; http.host; content:"169.254.169.254"; metadata:affected_product Open_WebUI, cve CVE-2026-87996; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87996; classtype:attempted-recon; sid:202687997; rev:1;)

Elastic Detection

sequence by user.name with maxspan=15s
  [ network where destination.port == 53 and dns.question.name : * ]
  [ network where destination.ip in
      ("169.254.169.254", "127.0.0.1", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
    and process.name : ("python*", "chrome*", "chromium*", "playwright*", "node*") ]

Splunk SPL Query

index=web OR index=proxy OR index=os
(process_name IN ("python*","chrome*","chromium*","playwright*","node*") OR app="open_webui")
(dest IN ("169.254.169.254","127.0.0.1","::1") OR cidrmatch("10.0.0.0/8",dest) OR cidrmatch("172.16.0.0/12",dest) OR cidrmatch("192.168.0.0/16",dest))
| stats count values(dest) as internal_targets values(url) as requested_urls by src, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="open_webui,cve-2026-87996,ssrf,">
  <rule id="2028796" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">SafePlaywrightURLLoader</field>
    <description>CVE-2026-87996: Open WebUI SafePlaywrightURLLoader invocation detected - possible SSRF/DNS rebinding</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="2028797" level="14">
    <if_sid>2028796</if_sid>
    <field name="message">169\.254\.169\.254|127\.0\.0\.1|localhost</field>
    <description>CVE-2026-87996: Open WebUI retrieval attempted access to internal/metadata address</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). The vendor states the issue is fixed in version 0.11.1, but no independent patch evidence (commit, advisory feed entry, or package registry record) was confirmed by any tracked source. Treat deployed instances as vulnerable until the 0.11.1 fix is verified in your environment.

1. Immediate mitigations

   • Restrict who can use URL ingestion and web search features; disable Playwright-backed URL loading where not essential.
   • Egress-firewall the Open WebUI host to deny connections to link-local (169.254.0.0/16), loopback, and RFC1918 ranges from the browser/retrieval process, and block access to the cloud metadata endpoint.
   • Enforce IMDSv2 (token-required) on cloud instances and apply least-privilege IAM roles to reduce metadata credential exposure.
   • Place Open WebUI in a segmented network with no unfiltered path to management or metadata services.
   • Monitor DNS and retrieval logs for hostnames resolving to benign addresses during validation and internal addresses during connection (rebinding signatures).

2. Patch / upgrade steps

   • Upgrade to Open WebUI 0.11.1 where feasible, since the vendor states the issue is fixed at that version.
   • Because patch confidence is 0/4, independently verify the fix: confirm the release notes/commit actually pins the validated IP to the browser request (or re-resolves and re-validates at connect time), rather than only changing Python-side validation.
   • Re-test with a controlled rebinding DNS setup after upgrade before considering the exposure closed.

3. Long-term hardening

   • Adopt a hardened fetch architecture: resolve once, validate, then connect by pinned IP with the Host header preserved (defeating rebinding), or route all retrieval through an explicit proxy with an egress allow-list.
   • Maintain a deny-by-default egress policy for any component that performs user-influenced outbound requests.
   • Continuously inventory self-hosted AI platform versions and treat any user-triggerable fetch path as an SSRF surface.

References

• NVD — CVE-2026-87996: https://nvd.nist.gov/vuln/detail/CVE-2026-87996
• CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: https://cwe.mitre.org/data/definitions/367.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Open WebUI project (vendor product home): https://github.com/open-webui/open-webui
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-87996 not listed)

Exploitation evidence: No public PoC, no Nuclei template, no exploit code, and no CISA KEV entry as of this report. No known threat actor campaigns are associated with this CVE in the available data.