Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL de…

Open WebUI versions 0.9.0 through 0.11.0 contain a Server-Side Request Forgery (SSRF) vulnerability related to improper IPv6 address validation. The platform's URL filtering mechanism used Python's ipaddress.is_global() to check only the literal IPv6 address without inspecting embedded IPv4 addresses in NAT64 transition encodings. On deployments with a NAT64 gateway, any authenticated user could encode internal or cloud-metadata IPv4 addresses using the NAT64 well-known prefix to bypass the filter. This allowed attackers to access internal network resources or cloud metadata services through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval features. The vulnerability poses a significant risk in cloud environments where instance metadata endpoints (e.g., AWS 169.254.169.254) could be accessed. The issue has been patched in Open WebUI version 0.11.0. A fix commit and security advisory have been published on GitHub.