CVE-2026-87999: Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open WebUIto a version that resolves this vulnerability.Fixed in 0.11.1 - Configuration
Upgrade to 0.11.1 to fix POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search so they no longer treat Python's globally routable address classification as proof that a destination is external.
Open WebUI (backend/open_webui/retrieval/web/utils.py) Web fetch destination classification = Use proper destination validation instead of Python's globally routable address classification as proof the destination is external
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Open WebUI user can exploit it. No user interaction is required, but exploitation requires access to the affected web retrieval endpoints.
Which deployments are most exposed?
Azure-hosted Open WebUI instances are specifically exposed because an attacker can cause the server to fetch content from the Azure platform channel at 168.63.129.16. Other reserved address ranges that were not rejected by the address classification may also be reachable.
What versions are affected and what is the fix?
Open WebUI versions prior to 0.11.1 are affected. Upgrade to version 0.11.1, which fixes the destination validation issue in the web retrieval processing endpoints.
How can I determine whether my instance is affected?
An instance is affected if it runs a version earlier than 0.11.1 and exposes POST /api/v1/retrieval/process/web or POST /api/v1/retrieval/process/web/search to authenticated users. Azure-hosted instances should treat successful server-side requests to 168.63.129.16 as an indication of exposure.