PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87996 open-webui CVE debrief

Open WebUI, a self-hosted AI platform, had a vulnerability in versions 0.9.6 to 0.11.1 that allowed an authenticated user to potentially expose internal services or cloud metadata by manipulating DNS responses. This issue is fixed in version 0.11.1. The vulnerability was caused by the SafePlaywrightURLLoader not properly validating user-controlled hostnames, which could lead to DNS manipulation and exposure of internal services or cloud metadata. Defenders and administrators of Open WebUI deployments should assess exposure and apply the patch, especially in environments with internal services or cloud metadata that could be at risk.

Vendor
open-webui
Product
Unknown
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-09
Original CVE updated
2026-09-16
Advisory published
2026-09-09
Advisory updated
2026-09-16

Who should care

Defenders and administrators of Open WebUI deployments, especially in environments with internal services or cloud metadata that could be at risk, should assess exposure and apply the patch.

Why it matters

CVE-2026-87996 is a high-severity vulnerability in Open WebUI that allows an authenticated user to potentially expose internal services or cloud metadata by manipulating DNS responses. Defenders should prioritize verifying exposure and applying the patch, especially in environments with internal services or cloud metadata that could be at risk.

  • Potential exposure of internal services or cloud metadata.
  • Risk of DNS manipulation by authenticated users.
  • Need for verification of current version and application of patch.

Technical summary

The SafePlaywrightURLLoader in Open WebUI did not properly validate user-controlled hostnames, allowing an authenticated user to potentially expose internal services or cloud metadata by manipulating DNS responses. This vulnerability, present in versions 0.9.6 through 0.11.1, could lead to DNS manipulation and exposure of internal services or cloud metadata. The issue is fixed in version 0.11.1, where proper validation of user-controlled hostnames was implemented to prevent such attacks. Defenders should prioritize verifying exposure and applying the patch, especially in environments with internal services or cloud metadata that could be at risk.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, especially in environments with internal services or cloud metadata that could be at risk.

Recommended defensive actions

  • Verify if Open WebUI is deployed in environments with internal services or cloud metadata that could be at risk.
  • Check if the current version of Open WebUI is 0.11.1 or later.
  • Apply the patch to prevent potential DNS manipulation.
  • Monitor for any suspicious activity related to internal services or cloud metadata exposure.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was reported in Open WebUI versions 0.9.6 through 0.11.1, where the SafePlaywrightURLLoader did not properly validate user-controlled hostnames, allowing for potential DNS manipulation.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87996 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87996

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87996 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87996

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.