Executive brief
Open WebUI is a platform that retrieves web content on behalf of users for features like document ingestion and web search. An authenticated user can bypass the server's internal-address protection and force it to fetch from Azure metadata endpoints or other reserved-use IP addresses, receiving the response back through the API. On deployments running in Azure, this exposes the Azure platform metadata channel that every virtual machine can reach, potentially leaking cloud credentials and configuration data.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the URL-fetching endpoints used for RAG ingestion and web search. The root cause lies in `backend/open_webui/retrieval/web/utils.py`, where address validation checked only whether an IP is "globally routable" according to Python's ipaddress library, treating that as a proxy for external reachability. However, several reserved addresses—including 168.63.129.16 (Azure platform channel), IPv4-translated ranges, and IPv6 site-local addresses—are classified as globally routable by IANA registry but are actually internal to specific platforms. Any authenticated user can POST to `/api/v1/retrieval/process/web` or `/api/v1/retrieval/process/web/search` with a crafted URL; the request passes validation, is issued by the server, and the response body is returned in the API response. This affects all versions prior to 0.11.1 when running with default settings (ENABLE_LOCAL_WEB_FETCH=false and empty WEB_FETCH_FILTER_LIST). The fix applies a default blocklist of reserved and internal-purpose ranges at both URL validation and connection time, covering redirects and DNS rebinding, with operators able to extend via WEB_FETCH_FILTER_LIST.
Affected products
- open-webui open-webui < 0.11.1
Timeline
- 2026-09-10: disclosed: Vulnerability advisory published
- 2026-09-10: patched: Fixed in version 0.11.1 via PR #27823
- 2026-08-30: other: Initial advisory date from GitHub