high · 7.1CVE-2026-87999Sep 10, 2026

CVE-2026-87999: Open WebUI SSRF via Azure Platform Channel Address Bypass

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A flaw in Open WebUI's address screening let any logged-in user trick the server into fetching internal Azure infrastructure endpoints, including the Azure platform channel, and read the response…

Packageopen-webui
Ecosystempip
Affected< 0.11.1
Fixed in0.11.1
CVE-2026-87999: Open WebUI SSRF via Azure Platform Channel Address Bypass

The problem

Open WebUI screens server-side URL fetches (RAG ingestion and web search) by asking Python's standard library whether a destination address is globally routable. That test is the wrong proxy for "external": it reflects IANA registry membership, not real-world reachability.

The Azure platform channel IP (168.63.129.16) is allocated from ordinary public IPv4 space, so the library correctly calls it global and the filter passes it through. On any Azure-hosted Open WebUI instance, that address reaches a platform endpoint the operator never intended to expose.

The same gap applied to IPv4-translated space and deprecated IPv6 site-local addresses (fec0::1).

Proof of concept

A working proof-of-concept for CVE-2026-87999 in open-webui, with the exact payload below.

http
POST /api/v1/retrieval/process/web HTTP/1.1
Host: <open-webui-host>
Authorization: Bearer <valid_user_token>
Content-Type: application/json

{"url": "http://168.63.129.16/?comp=versions"}

The vulnerable check in backend/open_webui/retrieval/web/utils.py called ip_address(resolved_addr).is_global and treated a truthy result as proof the destination was external. Because 168.63.129.16 is a public IANA allocation used by Microsoft as an internal platform channel, is_global returns True and the address clears the filter.

The patch (PR #27823, commit e3e4bd8) replaces the single is_global test with an explicit default block list of reserved and internal-purpose CIDR ranges, applied at URL validation time and again at connection time on both HTTP transports. This covers redirect hops and DNS rebinding.

Operators can extend the list via WEB_FETCH_FILTER_LIST but cannot remove the built-in defaults.

The fix

Upgrade to open-webui 0.11.1. If an immediate upgrade is not possible, add 168.63.129.16, 169.254.0.0/16, and fec0::/10 to WEB_FETCH_FILTER_LIST, and enforce egress filtering at the network level to block outbound connections to Azure platform and link-local ranges.

Reported by NaorYaa.

References: [1][2][3][4][5][6]

Related research