CVE-2026-70485
Received Received - Intake

Open WebUI IPv6 NAT64 Address Spoofing via RAG URL Ingestion

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in transition encodings. On a deployment with a NAT64 gateway, any verified user could wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval. This issue is fixed in 0.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-05
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-70485
EUVD
EUVD-2026-52890

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
open_webui open_webui From 0.9.0 (inc) to 0.11.0 (inc)
open_webui open_webui 0.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Open WebUI versions 0.9.0 to 0.11.0 allows authenticated users to bypass IP address validation by embedding IPv4 addresses within IPv6 transition encodings like NAT64. The system incorrectly treated these addresses as globally routable, enabling access to internal services or cloud metadata through crafted URLs.

Detection Guidance

Check Open WebUI version with: docker inspect open-webui | grep -i version. If version is between 0.9.0 and 0.11.0, the system is vulnerable. Review network logs for unusual URL requests containing NAT64 prefixes like 64:ff9b:: or similar IPv6 transition encodings accessing internal IPs.

Impact Analysis

An attacker could exploit this to access sensitive internal data or cloud metadata by sending specially crafted URLs. The impact depends on network configuration; only deployments using NAT64 gateways are vulnerable. Confidentiality is the primary concern as unauthorized data access may occur.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations must ensure proper IP validation to maintain compliance with data protection regulations.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.0 or later immediately. If upgrading is not possible, disable URL ingestion, URL-to-markdown conversion, and web-search features until patched. Review and restrict network access to prevent NAT64-based SSRF attacks by blocking IPv6 transition encodings at the firewall.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70485. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart