Open WebUI EUVD-2026-75180

The attacker must be an authenticated Open WebUI user - any registered account is sufficient (PR:L); unauthenticated exploitation is not possible. The attacker must control authoritative DNS for at least one domain and configure it to perform DNS rebinding (returning different IPs with zero or near-zero TTL across sequential queries). The Open WebUI instance must have web search or URL ingestion enabled, and the host must have network-layer reachability to the targeted internal service or cloud metadata endpoint. Exploitation achieves confidentiality impact only - reading internal service responses or cloud metadata (I:N in the CVSS vector). Deployments with strict egress firewall rules blocking RFC-1918 and link-local addresses are substantially protected even without the patch.

The CVSS 7.7 score with S:C/C:H reflects the genuine potential to reach cloud metadata services or internal APIs that may yield IAM credentials enabling further account compromise beyond the Open WebUI instance itself. The provided AC:L metric is contestable - successful exploitation requires the attacker to control authoritative DNS, a non-trivial prerequisite that in practice raises the attack bar beyond what AC:L typically implies; organizations running Open WebUI in cloud environments where 169.254.169.254 is reachable face the highest residual risk, and even a mid-sized operational team should treat upgrade to 0.11.1 as urgent if cloud credentials are available from the host network. PR:L correctly captures that any registered account suffices, and UI:N is accurate since the attacker's own URL submission drives the exploit. No EPSS score was supplied in the input data, no CISA KEV listing exists, and no public POC has been identified - all of which reduce immediate mass-exploitation risk. The realistic threat model is a malicious insider or compromised low-privilege account attempting to exfiltrate cloud credentials through the AI platform's URL ingestion feature.

An authenticated Open WebUI user registers a domain they control and configures its authoritative nameserver to return a legitimate public IP (e.g., 1.2.3.4) on the first query and 169.254.169.254 on subsequent queries with TTL set to zero. When they submit that domain as a URL for web ingestion, Python's validate_url() resolves the public IP and permits the request, but Playwright's independent resolution seconds later receives the IMDS address and fetches cloud instance metadata including IAM role credentials, which are returned in the ingestion response. No public POC has been identified, though DNS rebinding toolkits are widely available and the technique is well understood.