CVE-2026-87996

Katalog CVE

CVSS 7.7 · High EPSS 0,35%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada openwebui open webui. Skor CVSS 3.1 7.7 (High) menurut github.com.

Deskripsi (NVD)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion. This issue is fixed in version 0.11.1.

Rincian

Terbit di NVD

9 September 2026

Terakhir diubah

16 September 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/security/advisories/GHSA-4v28-j6q3-5m4r exploit · advisory vendor
• https://github.com/open-webui/open-webui/commit/27402ff210bfa253445720920dfb86b15a00327b patch
• https://github.com/open-webui/open-webui/pull/28634 issue tracking · patch
• https://github.com/open-webui/open-webui/releases/tag/v0.11.1 release notes