CVE-2026-87996: Open WebUI SSRF via DNS Rebinding in Playwright Loader

# CVE-2026-87996: Open WebUI SSRF via DNS Rebinding in Playwright Loader

https://gcdradar.vercel.app/incidents/cve-2026-87996-open-webui-ssrf-via-dns-rebinding-in-playwrig · AIR-2026-0916 · closed 2026-09-09

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-09-09 (happened 2026-09-10)
- AI role: Attack on AI
- Products: Open WebUI
- CVE ids: CVE-2026-87996
- CVSS: 7.7

## Summary

An SSRF vulnerability existed in Open WebUI when using the Playwright web loader due to secondary hostname resolutions bypassing initial safety checks. Attackers could exploit DNS rebinding to target internal services.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-09-10: CVE-2026-87996: Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader (https://github.com/advisories/GHSA-4v28-j6q3-5m4r)
- 2026-09-09: CVE-2026-87996: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. (https://nvd.nist.gov/vuln/detail/CVE-2026-87996)

## Sources

- 2026-09-09 NVD: CVE-2026-87996: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. https://nvd.nist.gov/vuln/detail/CVE-2026-87996
- 2026-09-10 GitHub Advisory Database: CVE-2026-87996: Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader https://github.com/advisories/GHSA-4v28-j6q3-5m4r

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.