CVE-2026-87999 in Open WebUI
Summary
by MITRE • 09/09/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in Open WebUI prior to version 0.11.1 represents a critical server-side request forgery risk stemming from flawed logic in handling network address classifications for external resources. The application, designed as an extensible and self-hosted AI platform, includes functionality that allows authenticated users to initiate retrieval processes against web-based content via specific API endpoints such as POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search. These endpoints rely on backend logic located in the file open_webui/retrieval/web/utils.py to determine whether a target destination is external or internal, thereby deciding how to process the request. The core technical flaw lies in the application's reliance solely on Python's standard library classification of globally routable addresses as definitive proof that a destination is external. This approach fails to account for reserved IP ranges and special-purpose addresses that are technically routable but should not be treated as public internet destinations, particularly within cloud environments like Microsoft Azure where specific internal metadata endpoints exist.
By treating any address classified by Python's standard library as globally routable without additional validation against a deny list or context-aware rules, the application inadvertently allows attackers to exploit reserved IP ranges that are accessible from the server environment but not intended for public retrieval. A notable example of this exploitation vector is the Azure platform channel endpoint located at 168.63.129.16. This address is a special-purpose IP used by Azure instances to access metadata and configuration information, which should never be fetched via external web retrieval mechanisms. Because the vulnerability allows authenticated users to trigger these requests, an attacker can force the backend server to fetch content from this internal endpoint or other reserved ranges that standard classification did not reject. This results in a Server-Side Request Forgery scenario where the application acts as a proxy for unauthorized access to sensitive infrastructure metadata and potentially other internal services exposed within the cloud network topology.
The operational impact of this vulnerability is significant, particularly for organizations deploying Open WebUI on Microsoft Azure or similar cloud platforms that utilize reserved IP ranges for internal communication channels. An authenticated attacker can leverage this flaw to perform SSRF attacks against internal endpoints, leading to potential information disclosure where sensitive configuration data, instance metadata, or other restricted resources are fetched and returned by the application. This exposure violates the principle of least privilege and compromises the isolation between the web-facing application layer and the underlying infrastructure. Furthermore, such vulnerabilities can serve as a stepping stone for more advanced attacks, including accessing internal databases or management interfaces that may not be directly exposed to the public internet but are reachable from within the cloud network segment where the Open WebUI instance resides.
To mitigate this vulnerability, organizations must upgrade immediately to version 0.11.1 of Open WebUI, which addresses the flawed address classification logic by implementing more robust validation mechanisms for external requests. In addition to upgrading, administrators should enforce strict egress filtering at the network level using firewalls or cloud security groups to block outbound connections to known reserved IP ranges such as those used by Azure metadata services. It is also recommended to implement a deny list of private and special-purpose address spaces in any custom retrieval logic if further customization is required. Aligning with industry standards, this vulnerability maps to CWE-918 Server-Side Request Forgery (SSRF) due to the improper restriction of web requests initiated by the server on behalf of a user. From an offensive security perspective, it aligns with MITRE ATT&CK technique T1504.003 Cloud Infrastructure Discovery via SSRF, highlighting how attackers can use compromised applications to map and access internal cloud resources that are otherwise protected from direct external access.