CVE-2026-70485 in Open WebUI
Summary
by MITRE • 08/04/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in transition encodings. On a deployment with a NAT64 gateway, any verified user could wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval. This issue is fixed in 0.11.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability in Open WebUI versions 0.9.0 through 0.11.0 represents a significant security flaw that undermines the platform's network isolation controls and exposes internal systems to potential exploitation. This issue stems from an incomplete implementation of IP address validation logic that fails to properly handle IPv4 addresses embedded within IPv6 transition encodings. The system's reliance on ipaddress.is_global for IPv6 address validation creates a critical gap in security controls, as it does not adequately examine the underlying IPv4 components that may be present in NAT64-encoded addresses.
The technical flaw manifests when a deployment environment includes a NAT64 gateway, which translates IPv6 addresses to IPv4 addresses for communication with internal networks. The vulnerability allows authenticated users to craft malicious URLs that appear to be globally routable due to the flawed validation mechanism, while actually containing internal IPv4 addresses embedded within the NAT64 prefix. This bypasses the intended security restrictions designed to prevent access to internal network resources through the platform's content retrieval features.
This vulnerability impacts several core functionalities of Open WebUI including RAG URL ingestion, URL-to-markdown conversion, and web-search content retrieval mechanisms. When exploited, an authenticated attacker can effectively gain access to internal systems, cloud metadata services, or other sensitive resources that should remain isolated from external access. The operational impact extends beyond simple information disclosure, as it potentially enables further exploitation through reconnaissance of internal network topology and service discovery.
The security implications align with CWE-20: Improper Input Validation, where the application fails to properly validate input parameters before processing them. This vulnerability also maps to ATT&CK technique T1566.002: Phishing via Service Provider, as it could enable attackers to craft malicious URLs that appear legitimate while accessing internal resources. The flaw represents a classic case of insufficient address validation in dual-stack network environments where IPv4 and IPv6 addresses coexist.
The fix implemented in version 0.11.0 addresses this issue by ensuring comprehensive IP address validation that properly examines both IPv4 and IPv6 components, including those embedded within transition encodings such as the NAT64 prefix. This enhancement ensures that all address types undergo proper validation before being processed for content retrieval, thereby maintaining the intended network isolation boundaries. Organizations should immediately upgrade to version 0.11.0 or later to remediate this vulnerability and prevent potential exploitation of internal network resources through the platform's URL handling capabilities.