DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-70485: CVE-2026-70485: Server-Side Request Forgery in Open WebUI via NAT64 IP Wrapping Bypass

#security #cve #cybersecurity

CVE-2026-70485: Server-Side Request Forgery in Open WebUI via NAT64 IP Wrapping Bypass

Vulnerability ID: CVE-2026-70485
CVSS Score: 7.1
Published: 2026-08-04

Open WebUI is susceptible to Server-Side Request Forgery (SSRF) when deployed in networks with NAT64 translation gateways. Authenticated users can bypass host validation checks by encapsulating internal or cloud-metadata IPv4 addresses within globally-routable IPv6 transition prefixes.

TL;DR

An SSRF vulnerability in Open WebUI allows authenticated users to access cloud metadata and internal assets by wrapping private IPv4 addresses in a NAT64 IPv6 prefix.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network (AV:N)
  • CVSS Score: 7.1 (High)
  • Exploit Status: Proof-of-Concept / Theoretical Analysis
  • CISA KEV Status: Not Listed
  • Impact: Information Disclosure / Confidentiality Bypass

Affected Systems

  • Open WebUI Deployments utilizing NAT64 gateways or dual-stack transition networks
  • open-webui: >= 0.9.0, < 0.11.0 (Fixed in: 0.11.0)

Code Analysis

Commit: 1717b49

Fix: SSRF validation bypass on NAT64 environments by implementing recursive IPv4 transition unwrap analysis.

Mitigation Strategies

  • Upgrade Open WebUI backend to version 0.11.0 or higher
  • Disable local web ingestion entirely via system configuration
  • Implement cloud security group rules to block outgoing traffic to link-local metadata endpoints

Remediation Steps:

  1. Update your deployment manifest or container image to point to tag 0.11.0 or higher.
  2. If unable to upgrade immediately, set the environment variable ENABLE_LOCAL_WEB_FETCH=False to disable external fetching.
  3. Deploy network policies to restrict access to local private network subnets (RFC 1918) and cloud link-local metadata (169.254.169.254).

References

Read the full report for CVE-2026-70485 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)