CWE-367

Critical Open WebUI TOCTOU DNS Rebinding SSRF Flaw Exposes Cloud Metadata and Internal VPC Services CVE-2026-87996

A critical TOCTOU race condition flaw CVE-2026-87996 in Open WebUI enables attackers to execute DNS rebinding SSRF attacks and harvest cloud metadata and credentials.