Vulnerability · Published Sep 9, 2026 · Assigned by GitHub_M
CVE-2026-87999Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
High 7.1
In plain English
A high-severity server-side request forgery in open-webui from open-webui. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | open-webui | 0.11.1 | GHSA-34r3-9m95-vq73 |
| PyPI | open-webui | 0.11.1 | PYSEC-2026-4116 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-webui | open-webui | < 0.11.1 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
References
- https://github.com/open-webui/open-webui/security/advisories/GHSA-34r3-9m95-vq73 x_refsource_CONFIRM
- https://github.com/open-webui/open-webui/pull/27823 x_refsource_MISC
- https://github.com/open-webui/open-webui/commit/e3e4bd87df6fc629e7e22081d980d55a7632b8b7 x_refsource_MISC
- https://github.com/open-webui/open-webui/releases/tag/v0.11.1 x_refsource_MISC