SSRF Vulnerability in Open WebUI via NAT64-encoded URLs

Open WebUI (v0.9.0 through v0.10.x) contains an SSRF vulnerability (CVE-2026-70485) stemming from insecure URL validation logic. When processing user-supplied URLs for RAG or web-search features, the application performs connectivity checks to ensure the destination is globally routable. However, this validation uses the ipaddress.ip_address(ip).is_global check on the literal IPv6 address, failing to account for embedded IPv4 addresses within NAT64 transition prefixes (specifically 64:ff9b::/96).

On cloud environments or Kubernetes clusters configured with NAT64 gateways, an attacker can mask internal IPv4 addresses (such as 169.254.169.254 or 127.0.0.1) using these prefixes. Because the literal IPv6 representation is technically globally routable, the filter is bypassed. The server subsequently fetches the internal content and returns the raw response body to the attacker via the API. This vulnerability allows low-privilege users to exfiltrate sensitive data, including IAM credentials from cloud instance metadata services or interface with admin endpoints bound to localhost.

Attack Chain

1. Attacker authenticates to an Open WebUI instance as a standard user.
2. Attacker selects a feature utilizing URL ingestion or web retrieval (e.g., /api/v1/retrieval/process/web).
3. Attacker identifies a target internal resource (e.g., Cloud Metadata service at 169.254.169.254).
4. Attacker encodes the target IPv4 address into the NAT64 well-known prefix (64:ff9b::/96) to create a literal IPv6 string.
5. Attacker submits the crafted URL (e.g., http://[64:ff9b::a9fe:a9fe]/latest/meta-data/) to the vulnerable API endpoint.
6. The application's validate_url() and _ssrf_safe_new_conn() logic incorrectly flag the NAT64-encoded literal as a valid global IPv6 address.
7. The backend performs an HTTP GET request to the internal destination via the NAT64 gateway.
8. The sensitive response body is returned to the attacker in the content field of the API response.

Impact

Successful exploitation leads to unauthorized read access to internal network services, private APIs, and cloud instance metadata. Attackers can retrieve IAM role credentials, allowing for potential lateral movement from the container to the broader cloud environment. The impact is restricted to deployments utilizing NAT64 gateways, which are standard in modern IPv6-only or dual-stack cloud/Kubernetes network architectures.

Recommendation

• Upgrade Open WebUI to version 0.11.0 or later to apply the patch for CVE-2026-70485, which correctly unwraps embedded IPv4 addresses before validation.
• Implement network-level egress filtering (Security Groups or Network Policies) to restrict the Open WebUI container from reaching internal cloud metadata IPs (e.g., 169.254.169.254) and private IP ranges.
• Monitor logs for requests to web-retrieval endpoints that contain literal IPv6 addresses starting with 64:ff9b.