{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/open-webui-0.10.0-0.10.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-70482"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["Open WebUI","Open WebUI (\u003c 0.11.0)","Open WebUI (0.9.6 to 0.10.x)","Open WebUI (0.10)","Open WebUI (0.10.0-0.10.2)","Open WebUI (0.9.0 to 0.10.2)"],"_cs_severities":["high"],"_cs_tags":["ssrf","vulnerability","cloud-security","web-application","cve-2026-70479","web-vulnerability","authorization-bypass","cve-2026-70494","xss","account-takeover"],"_cs_type":"advisory","_cs_vendors":["Open WebUI"],"content_html":"\u003cp\u003eOpen WebUI (v0.9.0 through v0.10.x) contains an SSRF vulnerability (CVE-2026-70485) stemming from insecure URL validation logic. When processing user-supplied URLs for RAG or web-search features, the application performs connectivity checks to ensure the destination is globally routable. However, this validation uses the \u003ccode\u003eipaddress.ip_address(ip).is_global\u003c/code\u003e check on the literal IPv6 address, failing to account for embedded IPv4 addresses within NAT64 transition prefixes (specifically \u003ccode\u003e64:ff9b::/96\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eOn cloud environments or Kubernetes clusters configured with NAT64 gateways, an attacker can mask internal IPv4 addresses (such as \u003ccode\u003e169.254.169.254\u003c/code\u003e or \u003ccode\u003e127.0.0.1\u003c/code\u003e) using these prefixes. Because the literal IPv6 representation is technically globally routable, the filter is bypassed. The server subsequently fetches the internal content and returns the raw response body to the attacker via the API. This vulnerability allows low-privilege users to exfiltrate sensitive data, including IAM credentials from cloud instance metadata services or interface with admin endpoints bound to localhost.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to an Open WebUI instance as a standard user.\u003c/li\u003e\n\u003cli\u003eAttacker selects a feature utilizing URL ingestion or web retrieval (e.g., \u003ccode\u003e/api/v1/retrieval/process/web\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target internal resource (e.g., Cloud Metadata service at 169.254.169.254).\u003c/li\u003e\n\u003cli\u003eAttacker encodes the target IPv4 address into the NAT64 well-known prefix (\u003ccode\u003e64:ff9b::/96\u003c/code\u003e) to create a literal IPv6 string.\u003c/li\u003e\n\u003cli\u003eAttacker submits the crafted URL (e.g., \u003ccode\u003ehttp://[64:ff9b::a9fe:a9fe]/latest/meta-data/\u003c/code\u003e) to the vulnerable API endpoint.\u003c/li\u003e\n\u003cli\u003eThe application's \u003ccode\u003evalidate_url()\u003c/code\u003e and \u003ccode\u003e_ssrf_safe_new_conn()\u003c/code\u003e logic incorrectly flag the NAT64-encoded literal as a valid global IPv6 address.\u003c/li\u003e\n\u003cli\u003eThe backend performs an HTTP GET request to the internal destination via the NAT64 gateway.\u003c/li\u003e\n\u003cli\u003eThe sensitive response body is returned to the attacker in the \u003ccode\u003econtent\u003c/code\u003e field of the API response.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to unauthorized read access to internal network services, private APIs, and cloud instance metadata. Attackers can retrieve IAM role credentials, allowing for potential lateral movement from the container to the broader cloud environment. The impact is restricted to deployments utilizing NAT64 gateways, which are standard in modern IPv6-only or dual-stack cloud/Kubernetes network architectures.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Open WebUI to version 0.11.0 or later to apply the patch for CVE-2026-70485, which correctly unwraps embedded IPv4 addresses before validation.\u003c/li\u003e\n\u003cli\u003eImplement network-level egress filtering (Security Groups or Network Policies) to restrict the Open WebUI container from reaching internal cloud metadata IPs (e.g., 169.254.169.254) and private IP ranges.\u003c/li\u003e\n\u003cli\u003eMonitor logs for requests to web-retrieval endpoints that contain literal IPv6 addresses starting with \u003ccode\u003e64:ff9b\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-05T02:01:37Z","date_published":"2026-08-04T20:00:53Z","id":"https://feed.craftedsignal.io/briefs/2026-08-open-webui-ssrf/","summary":"Authenticated users can bypass SSRF protection in Open WebUI by wrapping internal IPv4 addresses in NAT64 IPv6 transition prefixes, allowing unauthorized access to cloud metadata and internal network services.","title":"SSRF Vulnerability in Open WebUI via NAT64-encoded URLs","url":"https://feed.craftedsignal.io/briefs/2026-08-open-webui-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Open WebUI (0.10.0-0.10.2)","version":"https://jsonfeed.org/version/1.1"}