CVE-2026-87999: Open WebUI SSRF Vulnerability

CVE-2026-87999 Overview

CVE-2026-87999 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Open WebUI, an extensible self-hosted AI platform. Versions prior to 0.11.1 relied on Python's ipaddress globally routable classification to determine whether a fetch destination was external. The check failed to reject reserved ranges and cloud metadata endpoints. An authenticated user could force an Azure-hosted instance to fetch content from 168.63.129.16, the Azure platform channel reachable from every Azure VM. The flaw affects POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py. Version 0.11.1 resolves the issue.

Critical Impact
Authenticated attackers can pivot an Open WebUI server to reach internal cloud platform endpoints and other reserved address ranges, exposing metadata and internal services.

Affected Products

Open WebUI versions prior to 0.11.1
Deployments hosted on Azure are directly reachable to the platform channel at 168.63.129.16
Any instance exposing the retrieval/process/web and retrieval/process/web/search endpoints

Discovery Timeline

2026-09-09 - CVE-2026-87999 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87999

Vulnerability Analysis

The vulnerability resides in the web retrieval pipeline of Open WebUI. Two endpoints, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search, accept a user-supplied URL. The backend fetches the URL server-side and returns its contents to the caller. Before 0.11.1, the safety check treated Python's globally routable address classification as sufficient evidence that a destination was external. That classification does not exclude several sensitive reserved ranges, including cloud platform channels, IPv6 multicast, deprecated site-local prefixes, and various IETF-reserved blocks.

An authenticated user can supply a URL that resolves to 168.63.129.16, the Azure DHCP, DNS, and platform agent channel reachable from every Azure virtual machine. The server issues the outbound request and returns the response body to the attacker.

Root Cause

The root cause is incomplete allowlist logic in backend/open_webui/retrieval/web/utils.py. The classification used only the is_global heuristic and did not consult an explicit denylist of reserved and cloud metadata destinations. Reserved ranges such as Azure's 168.63.129.16, 192.88.99.0/24, IPv4 multicast 224.0.0.0/4, IPv6 site-local fec0::/10, and several never-routed IETF prefixes bypassed the check.

Attack Vector

Exploitation requires authentication and network access to the Open WebUI API. The attacker sends a crafted request to the web retrieval endpoint with a target URL. The server resolves the hostname, passes the global-routability check, and issues the fetch. On Azure, this exposes the platform channel, which can return host configuration data and interact with internal services.

python

# Patched denylist added in backend/open_webui/config.py (v0.11.1)
# Operators extend this through WEB_FETCH_FILTER_LIST.
DEFAULT_WEB_FETCH_FILTER_LIST = [
    '!169.254.169.254',
    '!fd00:ec2::254',
    '!metadata.google.internal',
    '!metadata.azure.com',
    '!100.100.100.200',
    '!168.63.129.16',      # Azure platform channel, reachable from every Azure VM
    '!192.88.99.0/24',     # 6to4 relay anycast, deprecated by RFC 7526
    '!224.0.0.0/4',        # IPv4 multicast
    '!::ffff:0:0:0/96',    # IPv4-translated (SIIT, RFC 2765), never routed
    '!64:ff9b:1::/48',     # NAT64 local-use prefix, RFC 8215
    '!100:0:0:1::/64',     # dummy prefix, RFC 9780
    '!2001:1::1',          # PCP anycast, RFC 7723
    '!2001:1::2',          # TURN anycast, RFC 8155
    '!2001:20::/28',       # ORCHIDv2, RFC 7343
    '!2001:30::/28',       # DRIP, RFC 9374
    '!5f00::/16',          # SRv6 SIDs, RFC 9602
    '!fec0::/10',          # IPv6 site-local, deprecated by RFC 3879
    '!ff00::/8',            # IPv6 multicast
]

Source: GitHub Commit e3e4bd87

Detection Methods for CVE-2026-87999

Indicators of Compromise

Outbound connections from the Open WebUI backend to 168.63.129.16 on TCP 80 or 32526
Requests to /api/v1/retrieval/process/web or /api/v1/retrieval/process/web/search containing URLs pointing to reserved IPv4 or IPv6 ranges
Application logs showing successful fetches of hosts inside 224.0.0.0/4, 192.88.99.0/24, or IPv6 multicast prefixes

Detection Strategies

Instrument the Open WebUI backend to log the resolved IP address for every outbound retrieval request, then alert on any address inside a reserved range
Correlate authenticated user activity with unusual outbound destinations from the application host
Review API access logs for repeated retrieval requests targeting IP literals or hostnames that resolve to cloud metadata endpoints

Monitoring Recommendations

Enable egress firewall logging on the Open WebUI host and alert on connections to 168.63.129.16 and other cloud platform channels
Ingest application and network logs into a SIEM to correlate SSRF probe patterns across users
Monitor CPU and network activity for anomalous retrieval bursts that may indicate reconnaissance of internal ranges

How to Mitigate CVE-2026-87999

Immediate Actions Required

Upgrade Open WebUI to version 0.11.1 or later, which consolidates address filtering on the request path
Restrict access to the retrieval API to trusted authenticated users only
Enforce egress network policies on the Open WebUI host that block traffic to cloud metadata endpoints and reserved ranges

Patch Information

The fix is available in Open WebUI v0.11.1 and was introduced through Pull Request #27823. The commit e3e4bd87 consolidates the web fetch address checks and expands DEFAULT_WEB_FETCH_FILTER_LIST with cloud platform channels and reserved IPv4 and IPv6 prefixes. Full details are in the GitHub Security Advisory GHSA-34r3-9m95-vq73.

Workarounds

Set the WEB_FETCH_FILTER_LIST environment variable to deny 168.63.129.16, 169.254.169.254, metadata.azure.com, and any reserved ranges relevant to your environment
Disable the ENABLE_RAG_LOCAL_WEB_FETCH feature if web retrieval is not required by your workflow
Place the Open WebUI backend in a network segment with strict egress rules that block cloud metadata and reserved destinations

bash

# Configuration example: deny Azure platform channel and other reserved ranges
export WEB_FETCH_FILTER_LIST="!168.63.129.16,!169.254.169.254,!metadata.azure.com,!metadata.google.internal,!224.0.0.0/4,!fec0::/10,!ff00::/8"