CVE-2026-87999

SSRF bypass: authenticated users can fetch Azure metadata via insecure routable address check.

• CVSS 7.1
• 918
• Input Validation and Sanitization
• Remote

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.

CVE

CVE-2026-87999

CWE

918

CVSS base score

7.1

Published

2026-09-09

OWASP

A10 Server-Side Request Forgery

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Python

Solution

Upgrade Open WebUI to version 0.11.1 or later.

import ipaddress
import requests

def fetch_external(url: str) -> str:
    """
    Retrieve content from a user‑provided URL after a naive external‑host check.
    """
    # VULNERABLE: uses ip.is_global as sole external check
    host = url.split("://", 1)[-1].split("/", 1)[0]
    ip = ipaddress.ip_address(host)
    if not ip.is_global:
        raise ValueError("Only globally routable addresses are allowed")
    resp = requests.get(url, timeout=5)
    return resp.text

import ipaddress
import requests

def fetch_external(url: str) -> str:
    """
    Retrieve content from a user‑provided URL after strict external‑host validation.
    """
    # FIX: reject private, reserved and loopback ranges in addition to global check
    host = url.split("://", 1)[-1].split("/", 1)[0]
    ip = ipaddress.ip_address(host)
    if not (ip.is_global and not ip.is_private and not ip.is_reserved and not ip.is_loopback):
        raise ValueError("Only public, non‑reserved addresses are allowed")
    resp = requests.get(url, timeout=5)
    return resp.text

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202687999,
  title        = {{SSRF bypass: authenticated users can fetch Azure metadata via insecure routable address check.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-87999},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-87999/}}
}