Open WebUI SSRF Vulnerability via Playwright Sub-resources (CVE-2025-70479)

Vulnerability Overview Vulnerability Name: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader Description: When the Playwright web loader is enabled, Open WebUI allows user-submitted URLs to be verified for their target address in a real browser before the request is issued. This check only applies to top-level page requests. Other page requests (such as addresses accessed via JavaScript) are not validated, allowing attackers to exploit this to access internal services. Affected Versions Affected Versions: >= 0.9.6, = 0.11.0 CVSS Score: 7.7 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None Remediation Fixed Version: Upgrade to version 0.11.0 or later Specific Remediation Details: In version 0.11.0, every intercepted request is validated, redirects are disabled, and validation is re-performed after each redirect. This prevents any sub-resource from reaching non-public addresses. The same changes also block two paths that never reached the interceptor: service-worker requests, WebSocket connections, etc. Preconditions must be enabled (this is not the default setting; default web loader deployments are not affected) An accessible Playwright browser, either local or remote Any authenticated user can submit a URL for scraping or trigger a web search; administrative privileges are not required Notably, services accessible to the browser on the network are not leaked if the deployed browser container has no routing to internal services Impact Attackers can read HTTP responses from services reachable by the browser process, including cloud instance metadata, other containers on the same network, and internal APIs bound to private addresses. Content is returned to the user through normal web search or document ingestion results. This is a read-only operation, non-blind, does not provide write access, does not affect availability, and does not exceed the scope allowed by the browser's network location. Fix Details Fix Commit: Specific Remediation Details: Every intercepted request is validated, redirects are disabled, and validation is re-performed after each redirect. This prevents any sub-resource from reaching non-public addresses. The same changes also block two paths that never reached the interceptor: service-worker requests, WebSocket connections, etc. Root Cause Affected Component: in , including synchronous and asynchronous request interceptors. Affected Configuration: Deployments running only the Playwright web loader. Proof of Concept (POC) Reported Against Version: 0.10.2 POC Code: Credits Reporter: @edwardv970 Fix Developer: Classic298 Additional Information CVE ID: CVE-2025-70479 Weakness Type: CWE-918 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality: High - Integrity: None - Availability: None Summary This vulnerability allows attackers to access internal services via unvalidated sub-resource requests. While the impact is significant, it can be remediated by upgrading to version 0.11.0 or later.

Goal Reached Thanks to every supporter — we hit 100%!

Open WebUI SSRF Vulnerability via Playwright Sub-resources (CVE-2025-70479)

More from this source