Authenticated users can bypass SSRF protection in Open WebUI by wrapping internal IPv4 addresses in NAT64 IPv6 transition prefixes, allowing unauthorized access to cloud metadata and internal network services.
PoC
Open WebUI +5
ssrf
vulnerability
cloud-security
web-application
cve-2026-70479
web-vulnerability
authorization-bypass
cve-2026-70494
+2
2r
6t
1c
updated