SSRF (Server-Side Request Forgery) in open-webui (CVE-2026-87999)
Summary
SSRF in open-webui (CVE-2026-87999). Confidential information can be exposed externally. Exploitable via POST /api/v1/retrieval/process/web. Mitigation: upgrade to 0.11.1 or later.
Original description
The description as published by the source.
Summary
Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is globally routable. Several addresses reserved for internal use answer yes to that question, including 168.63.129.16, the Azure platform channel every Azure virtual machine can reach. Any authenticated user could therefore make the server issue requests to those addresses and read the responses back through the API.
Preconditions
- The affected paths are the server-side URL fetches: RAG URL ingestion and web search. Both require an authenticated, verified account. No administrator role and no special workspace permission are needed.
ENABLE_LOCAL_WEB_FETCHmust be at its default offalse. Setting it totruedisables the address screen by design, and internal destinations are reachable on purpose.WEB_FETCH_FILTER_LISTis empty by default in affected versions, so no operator-supplied block entry covered these addresses unless one was added by hand.- For the Azure platform channel specifically, the Open WebUI host must run on Azure (virtual machine, AKS, Container Apps or equivalent). That address is reachable from every Azure virtual machine regardless of network security group rules. On a host that is not on Azure the address routes nowhere and nothing is reachable throu…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-87999 has been found in open-webui.
Attackers can target a specific entry point like POST /api/v1/retrieval/process/web over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 7.1/10.
What to do: upgrade open-webui to 0.11.1 or later.
If unsure, ask your IT team or search "open-webui CVE-2026-87999" on the vendor's site.
CVE-2026-87999 (open-webui) — CWE-918 / CVSS v3 7.1
Attack vector: remote (network-reachable) / no user interaction
Attack surface: POST /api/v1/retrieval/process/web / POST /api/v1/retrieval/process/web/search / ENABLE_LOCAL_WEB_FETCH / false
Patched: 0.11.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
SSRF (CWE-918) exists in open-webui. Attackers reach the vulnerable code path via POST /api/v1/retrieval/process/web.
Check the vendor advisory for the affected versions of open-webui. Attack surface: POST /api/v1/retrieval/process/web / POST /api/v1/retrieval/process/web/search / ENABLE_LOCAL_WEB_FETCH / false.
Severity: High (CVSS 7.1/10). Confidential information can be exposed externally.
Update to 0.11.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual POST /api/v1/retrieval/process/web requests with malformed payloads or SQL meta-characters. Run grep -r 'open-webui' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'open-webui' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
open-webuiを grep し、稼働しているサービス・バージョンを把握する。 -
2Hunt for indicators of compromise detect
grep 'POST /api/v1/retrieval/process/web' /var/log/nginx/access.log | grep -E '(unusual_payload|sqli_pattern)'アクセスログで
POST /api/v1/retrieval/process/webへの異常なリクエスト (不正な認証ヘッダ・SQLメタ文字)を過去 30〜90日分捜索。WAF/SIEM があれば該当パスのアラート発火履歴を確認。 -
3Apply patch patch
Upgrade open-webui to 0.11.1ステージング環境で 0.11.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 2 で見つけた異常検知の続報チェックを含めること。
-
4Post-deployment verification verify
Replay attack against POST /api/v1/retrieval/process/web on staging to confirm patch closes the vectorパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 2 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- package pypi.org
- web github.com
- web github.com
- web github.com
- web github.com