Securaity Browse advisories
SA-26-617 High

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI

More for Open WebUI RSS feed for Open WebUI

Severity
High, CVSS 7.1
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Record
CVE-2026-87999
Affects
Open WebUI
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
September 9, 2026
Source last modified
September 16, 2026

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.

Description quoted from the NVD record.

Who is affected

Open WebUI is a self-hosted chat interface that lets people use AI models from a web browser. This flaw affects versions before 0.11.1, in the feature that fetches web pages and web search results for use in chats. Any user with an account could make Open WebUI fetch and return content from addresses it should not reach. On copies hosted on Azure, this includes Azure's internal platform channel and other reserved address ranges. This flaw is rated High.

What to do

  1. The person who installed or runs Open WebUI for your organization should check which version is in use.
  2. If it is older than 0.11.1, update to version 0.11.1 or later, which fixes this flaw.
  3. If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update will be done.
  4. Treat the update as especially urgent if your copy of Open WebUI is hosted on Azure, because that is the setup where this flaw can reach Azure's internal platform channel.

Analysis written from the source record as of September 16, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all