CVE-2026-87996

Open WebUI versions 0.9.6 through versions before 0.11.1 contain a time-of-check-to-time-of-use (TOCTOU) flaw in SafePlaywrightURLLoader (backend/open_webui/retrieval/web/utils.py): the backend validates a user-supplied hostname in Python, but the Playwright browser then resolves the same hostname again in its sync and async request interceptors, so the two lookups can return different addresses. An authenticated user who controls the authoritative DNS for a submitted hostname — via the web search or URL ingestion features — can answer the validation lookup with a public address while steering the browser to an internal address. This lets the attacker read responses from internal services or the instance's cloud metadata endpoint through the web UI, producing a high-confidentiality impact with no integrity or availability impact per the CVSS score. Any self-hosted Open WebUI deployment running an affected version is exposed where the attacker can obtain an account, since the flaw requires only low privileges and no user interaction. The issue is fixed in version 0.11.1; there is no public proof of concept, it is not in CISA KEV, and no exploitation is currently known.

What to do: Upgrade to Open WebUI 0.11.1 or later. Until upgraded, restrict web search and URL ingestion to trusted accounts, disable open self-registration where not needed, and apply egress controls from the Playwright/browser environment (block internal address ranges and the cloud metadata endpoint, e.g. 169.254.169.254). Because exploitation depends on attacker-controlled DNS, instances that do not ingest untrusted URLs face little risk.