# Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Open WebUI's Playwright loader validated only the top-level document URL, so page JavaScript could fetch internal addresses like cloud metadata and return the responses to the user.

- Payout: Research
- Severity: high
- Program: Open WebUI
- Found by: edwardav970
- Disclosed: 2026-08-04
- CVE: CVE-2026-70479
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-w2rx-84hp-gg95
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-w2rx-84hp-gg95
- Tags: area:ai domain:ai domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:python technique:source-review vuln:ssrf

**Target:** Playwright web loader request interceptor (SafePlaywrightURLLoader)
**Root cause:** The request interceptor returned early for any resource type other than `document`, so only the top-level navigation was address-validated; all sub-resource requests issued by the page's own scripts bypassed the check.
**Steps:**
1. Enable `WEB_LOADER_ENGINE=playwright` with a reachable browser (local or `PLAYWRIGHT_WS_URL`).
2. Submit a URL whose page JavaScript issues sub-resource requests to `http://169.254.169.254/latest/meta-data/`.
3. Interceptor aborts the `document` request type but continues every other resource type unvalidated.
4. Page reads the internal response and the loader returns the final DOM to the requesting user via web-search/RAG output.
**How found:** Reporter noticed address validation was applied only to the top-level document request, then drove the interceptor directly with stand-in route/request objects, one call per resource type, against the metadata endpoint to confirm only `document` was aborted.
**Exploitation:** An authenticated user submits an attacker-controlled URL for ingestion or triggers a web search; the page's scripts fetch internal endpoints (cloud metadata, sibling containers, private-bound APIs) and the resulting DOM is returned to the user, giving a non-blind read primitive limited to the browser's network position.
**Insight:** When auditing browser-based SSRF guards, enumerate every Playwright resource type and the paths that skip the route handler entirely — service workers and WebSockets — since validating only `document` leaves the page's own script-initiated requests unchecked.