CVE-2026-87999

Executive Summary

CVE-2026-87999 is a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI, a self-hosted AI platform, affecting all versions prior to 0.11.1. The flaw resides in the web retrieval endpoints POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search, which incorrectly relied on Python's globally routable address classification to determine whether a destination was external. An authenticated attacker can abuse this to force an Azure-hosted instance to fetch and return content from 168.63.129.16 — the Azure platform channel — as well as other reserved address ranges that the standard classification failed to reject, resulting in unauthorized access to internal metadata and platform services.

Technical Analysis

Open WebUI is an extensible, self-hosted AI platform that provides a web-based interface, retrieval-augmented generation (RAG) capabilities, and integration with external content sources. The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and resides in the web retrieval subsystem, specifically within backend/open_webui/retrieval/web/utils.py. This module is responsible for fetching content from external URLs that users submit through the web-processing API endpoints.

The core defect is an incomplete SSRF protection mechanism. Prior to version 0.11.1, the application determined whether a destination URL was "external" by relying on Python's classification of globally routable addresses (e.g., the semantics behind ipaddress.IPv4Address.is_global). While this approach rejects many conventional private ranges such as RFC 1918 space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and loopback (127.0.0.0/8), it does not comprehensively cover all reserved or special-purpose address ranges. Specifically, 168.63.129.16 — the Azure platform channel used for host-level communication, DHCP, DNS, and health probing on Azure virtual machines — is classified as globally routable by Python's address logic, and therefore passed the validation check. Other reserved ranges that the standard classification does not reject were similarly reachable.

The attack surface is the two authenticated REST endpoints:

• POST /api/v1/retrieval/process/web
• POST /api/v1/retrieval/process/web/search

Any authenticated user, including one with low privileges, can supply a URL pointing to a restricted destination. Because these endpoints fetch content on the server's behalf and return the retrieved content to the requester, the server acts as a proxy that can reach internal resources the attacker cannot access directly. The vulnerability requires authentication (PR:L) and is non-trivial to exploit due to the specific destination targeting required (AC:H), but the scope change (S:C) reflects that the vulnerable component impacts resources beyond its own security authority — namely the underlying cloud platform services. The confidentiality impact is high (C:H) because sensitive platform channel data can be read, while integrity impact is low (I:L) and availability impact is none (A:N).

The fix in version 0.11.1 strengthens the destination validation logic to reject the Azure platform channel address and other reserved ranges that the globally-routable classification alone did not cover.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the vulnerability class (SSRF) and the behavior described in the NVD entry. No specific function or variable names beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies an Open WebUI instance exposed on the internet or an internal network, and confirms it is hosted on Microsoft Azure (e.g., via response headers, hosting fingerprinting, or self-hosted context knowledge). The attacker must possess valid credentials for the instance — even a low-privileged account is sufficient, as the endpoints are accessible to authenticated users.

2. Triggering the vulnerability. Using the authenticated session, the attacker sends a request to POST /api/v1/retrieval/process/web or POST /api/v1/retrieval/process/web/search, supplying a target URL that resolves to 168.63.129.16 or another reserved address not blocked by Python's globally-routable classification. Because the server-side validation logic at backend/open_webui/retrieval/web/utils.py treats that address as external, the request is not rejected.

3. Payload / execution method. The server fetches the attacker-supplied URL and returns the response body to the caller. At the vulnerability-class level, this is a classic SSRF: the attacker does not execute code directly but leverages the server's network position and trust to retrieve content that should be inaccessible. The Azure platform channel at 168.63.129.16 exposes host-level services (health probing, DHCP, DNS, and metadata-adjacent functions) that respond over HTTP, allowing retrieval of platform-generated data.

4. Post-exploitation impact. The attacker obtains content from the Azure platform channel and any other reachable reserved ranges, potentially disclosing host-level configuration, network metadata, and platform-internal service responses. This information can support lateral movement, privilege escalation, or further enumeration of the cloud environment. Because the endpoints return fetched content directly, exfiltration is straightforward once a reachable internal destination is identified.

Impact Assessment

The CVSS 3.1 base score is 7.1 (High), with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. The network attack vector (AV:N) means exploitation can occur remotely without adjacency to the target. The high attack complexity (AC:H) reflects the requirement to target specific reserved addresses and Azure-specific infrastructure, making exploitation non-trivial but feasible. Low privileges (PR:L) indicate any authenticated user qualifies, and no user interaction (UI:N) is required beyond the attacker's own actions.

The most significant metric is the scope change (S:C), which acknowledges that the vulnerable component — Open WebUI — affects resources beyond its own security authority, specifically the Azure platform channel. Confidentiality impact is high (C:H), as sensitive platform data can be read; integrity impact is low (I:L), reflecting limited ability to alter state; availability impact is none (A:N).

Business impact centers on confidentiality of cloud platform internals. Affected systems are self-hosted Open WebUI deployments, particularly those running on Azure. The blast radius includes the Open WebUI instance and, through the SSRF channel, the underlying Azure host platform services. Multi-tenant or shared cloud environments increase the sensitivity of any disclosed platform data. Organizations running Open WebUI for internal AI workloads, RAG pipelines, or document-processing workflows should treat this as a high-priority finding.

Detection Guidance

Sigma Rule

title: Open WebUI SSRF via Web Retrieval Endpoints
id: 8f3a2c1e-7b4d-4e9a-9c2f-1a6d5e8b3f70
status: experimental
description: Detects attempts to exploit CVE-2026-87999 by submitting requests to Open WebUI web retrieval endpoints with reserved or Azure platform channel addresses.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87999
author: Valters IT Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026.87999
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/api/v1/retrieval/process/web'
      - '/api/v1/retrieval/process/web/search'
  selection_azure:
    cs-uri-query|contains:
      - '168.63.129.16'
  selection_reserved:
    cs-uri-query|re:
      - '169\.254\.'
      - '100\.64\.'
      - '192\.0\.0\.'
      - '198\.18\.'
  condition: selection_endpoint and (selection_azure or selection_reserved)
falsepositives:
  - Legitimate administrative testing
level: high

YARA Rule

rule CVE_2026_87999_OpenWebUI_SSRF
{
    meta:
        description = "Detects SSRF payloads targeting Open WebUI web retrieval endpoints (CVE-2026-87999)"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87999"
        severity = "high"

    strings:
        $ep1 = "/api/v1/retrieval/process/web" ascii wide nocase
        $ep2 = "/api/v1/retrieval/process/web/search" ascii wide nocase
        $azure = "168.63.129.16" ascii wide
        $linklocal = "169.254." ascii wide
        $cgnat = "100.64." ascii wide

    condition:
        ($ep1 or $ep2) and ($azure or $linklocal or $cgnat)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87999 Open WebUI SSRF Attempt via Web Retrieval Endpoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/retrieval/process/web"; http.uri; content:"168.63.129.16"; classtype:attempted-recon; reference:cve,2026-87999; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87999; sid:202687999; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=30s
  [http where http.request.method == "POST" and
     wildcard(http.request.path, "/api/v1/retrieval/process/web*")]
  [http where stringContains(http.request.body, "168.63.129.16") or
     stringContains(http.request.body, "169.254.") or
     stringContains(http.request.body, "100.64.")]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="/api/v1/retrieval/process/web" OR uri_path="/api/v1/retrieval/process/web/search")
| search (uri_query="*168.63.129.16*" OR uri_query="*169.254.*" OR uri_query="*100.64.*" OR uri_query="*192.0.0.*" OR uri_query="*198.18.*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, user
| sort - count

Wazuh OSSEC Rule

<group name="web,open_webui,ssrf,">
  <rule id="100879" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/api/v1/retrieval/process/web</field>
    <match>168.63.129.16|169.254\.|100\.64\.|192\.0\.0\.|198\.18\.</match>
    <description>CVE-2026-87999: Possible Open WebUI SSRF attempt targeting reserved/Azure platform address</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87999,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because no patch evidence exists in tracked sources, organizations should treat this as unpatched at the operational level until vendor confirmation. Restrict access to the /api/v1/retrieval/process/web and /api/v1/retrieval/process/web/search endpoints to trusted users only. Enforce network egress controls that block outbound requests from Open WebUI hosts to 168.63.129.16 and other reserved ranges (e.g., 169.254.0.0/16, 100.64.0.0/10, 192.0.0.0/24, 198.18.0.0/15). Deploy a forward proxy with strict allowlisting for the retrieval subsystem so all fetches are validated against an explicit destination policy rather than relying on address classification. Monitor authentication events for low-privileged accounts accessing retrieval endpoints unexpectedly.

2. Patch / upgrade steps. Upgrade to Open WebUI version 0.11.1, which the NVD description states fixes the issue by correcting the destination validation logic in backend/open_webui/retrieval/web/utils.py. Validate the deployed version by inspecting the running container image tag or application version endpoint. Because patch confidence is currently 0/4 with no vendor fix listed in tracked sources, independently verify the availability of 0.11.1 from the official Open WebUI release channel before relying on it, and re-test the endpoints after upgrade.

3. Long-term hardening. Replace address-classification-based SSRF defenses with a proof-of-ownership or allowlist model: resolve the target, validate every resolved IP against a comprehensive deny list of all reserved, link-local, and cloud-provider platform ranges, and re-validate after DNS rebinding. Run Open WebUI retrieval workloads in a restricted network segment with no route to cloud platform channels or internal management networks. Apply least-privilege IAM roles to the instance's managed identity to limit the value of any SSRF-accessible metadata. Maintain a standing process to subscribe to Open WebUI security advisories and to re-score patch confidence as evidence emerges.

References

• NVD — CVE-2026-87999: https://nvd.nist.gov/vuln/detail/CVE-2026-87999
• Open WebUI project (official releases and advisories): https://github.com/open-webui/open-webui
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• CISA Known Exploited Vulnerabilities Catalog (currently NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-87999 at the time of writing. The EPSS score has not yet been assigned by FIRST.org.