CVE-2026-70479 in Open WebUI
Summary
by MITRE • 08/04/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEB_LOADER_ENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated user can use JavaScript to reach blocked internal addresses, and returned DOM can include data read from those addresses in web-search or RAG output. This issue is fixed in 0.11.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability exists within Open WebUI versions ranging from 0.9.6 through 0.11.0 when the WEB_LOADER_ENGINE environment variable is set to playwright. This configuration introduces a critical validation flaw that undermines the platform's security boundaries. The core issue stems from Playwright's web loader implementation which only validates the initial top-level page request while allowing subsequent sub-resource requests to bypass validation entirely. This selective validation creates an exploitable gap in the security architecture where authenticated users can leverage JavaScript execution capabilities to access internal network addresses that should remain blocked.
The technical flaw represents a classic case of incomplete input validation and insufficient request filtering mechanisms. When Playwright processes web pages, it properly validates the main page load but fails to apply equivalent validation controls to subordinate resource requests such as CSS files, JavaScript libraries, images, or API calls that occur during page rendering. This partial validation allows malicious actors with authenticated access to craft JavaScript payloads that can traverse internal network boundaries through legitimate browser mechanisms. The vulnerability aligns with CWE-20, which addresses improper input validation, and specifically demonstrates weaknesses in web application security controls.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks within the network environment. An authenticated user can construct web pages that include JavaScript code capable of making requests to internal services that are normally restricted from external access. When these pages are processed through the web loader, the returned DOM content may contain data retrieved from these previously blocked internal addresses. This data inclusion in web-search or RAG outputs creates a vector for sensitive information leakage, potentially exposing internal system details, configuration data, or private resources that should remain isolated.
This vulnerability directly relates to ATT&CK technique T1071.004 which covers application layer protocol: DNS, and more broadly addresses privilege escalation and lateral movement through application-level attacks. The flaw enables an authenticated user to effectively bypass network segmentation controls by leveraging the legitimate browser-based access patterns that are permitted within the platform's architecture. The security implications extend to potential data exfiltration scenarios where internal resources could be accessed and their contents returned in search results or RAG responses, creating a covert channel for information harvesting.
The mitigation strategy involves upgrading to Open WebUI version 0.11.0 or later where the validation mechanism has been corrected to apply comprehensive filtering across all requests including sub-resources. Organizations should also implement additional network-level controls such as web application firewalls that can monitor and filter requests based on destination addresses, even when using browser-based loading mechanisms. The fix demonstrates proper security engineering practices by ensuring complete request validation rather than partial validation that leaves gaps in the security posture. Configuration management should enforce that WEB_LOADER_ENGINE is not set to playwright in environments where internal network access restrictions are critical for maintaining security boundaries.
Security teams should conduct thorough penetration testing to verify that the updated validation mechanisms properly filter all resource requests and implement monitoring for any suspicious activity related to web loading operations. The vulnerability highlights the importance of comprehensive security testing across all components of web application architectures, particularly those involving browser automation frameworks where the distinction between primary and secondary requests can create unexpected security gaps. Organizations should also review their incident response procedures to account for potential information leakage scenarios that could arise from similar validation flaws in other platforms or applications.