CVE-2026-87999

CVE-2026-87999 is a server-side request forgery flaw (CWE-918) in Open WebUI, an open-source, self-hosted AI platform, affecting all versions before 0.11.1. The endpoints POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py relied on Python's globally routable address classification to decide whether a destination was external, so reserved ranges that this check did not reject could still be requested. An authenticated user could therefore make the server fetch and return content from 168.63.129.16, the Azure platform channel, and other reserved ranges, gaining high-impact access to response data (confidentiality: high) with limited integrity impact across a security-scope boundary, which matters most for instances hosted on Microsoft Azure. Any self-hosted Open WebUI deployment prior to 0.11.1 that exposes the retrieval API to authenticated users is affected, with Azure-hosted instances facing the greatest risk. There is no evidence of exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and the advisory was assigned by GitHub's CNA.

What to do: Upgrade to Open WebUI 0.11.1 or later, which corrects the address classification used by the web retrieval utilities. Prioritize patching Azure-hosted deployments, restrict which authenticated users can call /api/v1/retrieval/process/web and /api/v1/retrieval/process/web/search, and review server logs for fetches to 168.63.129.16 or other reserved ranges.