CVE-2026-87999

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Published Sep 9, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.

Analysis

Technical impact

An authenticated user of Open WebUI can cause the server to perform a web request to the Azure internal IP 168.63.129.16 via the POST /api/v1/retrieval/process/web and /api/v1/retrieval/process/web/search endpoints. This Server‑Side Request Forgery (CWE‑918) allows the attacker to retrieve data from a protected Azure platform channel that is normally unreachable from the public internet, potentially exposing internal information or services that should be hidden.

Affected Systems

This flaw affects installations of Open WebUI prior to version 0.11.1. The fix was included in the 0.11.1 release. All instances running older versions are vulnerable.

Risk and Exploitability

With a CVSS score of 7.1 the vulnerability is considered medium‑to‑high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires authentication to the application; an attacker can trigger outbound requests to Azure internal addresses by submitting a crafted request. Because the attacker cannot execute arbitrary code, the impact is limited to potential data exposure and network reconnaissance. However, the ability to reach Azure internal services may aid in further attacks if additional credentials or lateral movement capabilities are obtained.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

open-webui

affected

Version	Status	Constraints
`< 0.11.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Open-webui

Version	Status	Scheme	Platform
`[0,0.11.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Open WebUI to version 0.11.1 or later to apply the official fix.
If an immediate upgrade is not possible, block outbound traffic to Azure internal IP ranges such as 168.63.129.16 in the host firewall or network configuration.
Restrict the use of the web retrieval endpoints by removing them from the application or limiting access to only trusted users, and apply the principle of least privilege to authenticated accounts.

Generated by OpenCVE AI on September 9, 2026 at 22:20 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-34r3-9m95-vq73	Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.360% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/open-webui/open-webui/commit/e3e4bd87df6fc629e7e22081d980d55a7632b8b7
https://github.com/open-webui/open-webui/pull/27823
https://github.com/open-webui/open-webui/releases/tag/v0.11.1
https://github.com/open-webui/open-webui/security/advisories/GHSA-34r3-9m95-vq73

History

Sep 16, 2026 3:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openwebui Openwebui open Webui
CPEs		cpe:2.3:a:openwebui:open_webui::::::::
Vendors & Products		Openwebui Openwebui open Webui

Sep 10, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 10, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Open-webui Open-webui open-webui
Vendors & Products		Open-webui Open-webui open-webui

Sep 9, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.
Title		Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Weaknesses		CWE-918
References		https://github.com/open-webui/open-webui/commit/e3e4bd87df6fc629e7e22081d980d55a7632b8b7 https://github.com/open-webui/open-webui/pull/27823 https://github.com/open-webui/open-webui/releases/tag/v0.11.1 https://github.com/open-webui/open-webui/security/advisories/GHSA-34r3-9m95-vq73
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N'}`