CVE-2026-70485 Details
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in transition encodings. On a deployment with a NAT64 gateway, any verified user could wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval. This issue is fixed in 0.11.0.
A vulnerability in Open WebUI versions 0.9.0 prior to 0.11.0 allows authenticated users to access internal services and cloud metadata by exploiting NAT64-encoded URLs. The application failed to properly validate IPv6 addresses embedded with transition encodings, enabling the bypass of URL filters that are meant to prevent access to sensitive internal resources. This issue is particularly relevant for deployments with a NAT64 gateway, where the vulnerability can be exploited to retrieve private metadata and IAM role credentials.
Users can upgrade to Open WebUI version 0.11.0 or later, where this vulnerability has been fixed. The update addresses the address validation flaw by correctly inspecting all standardized transition encodings before applying the global reachability check, ensuring that NAT64-wrapped public destinations continue to function as intended.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-webui/open-webui/security/advisories/GHSA-8x5v-cpv7-8jjp | CISA-ADP | ExploitVendor Advisory |
| https://github.com/open-webui/open-webui/commit/1717b493d83c86afa82aa8bc50139250852dd2f3 | [email protected] | Patch |
| https://github.com/open-webui/open-webui/releases/tag/v0.11.0 | [email protected] | Release Notes |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-8x5v-cpv7-8jjp | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwebui open webui | >= 0.9.0, < 0.11.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |