Is CVE-2026-87999 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87999 being exploited in the wild.

How severe is CVE-2026-87999?

High severity, with a CVSS score of 7.1, published 9 September 2026.

Which products and versions are affected?

open-webui (PyPI) < 0.11.1, ECOSYSTEM:introduced=0,fixed=0.11.1.

Is there a fix for CVE-2026-87999?

Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87999 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87999?

Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87999: Open WebUI server-side request forgery in URL fetching

Q: Which products and versions are affected?

open-webui (PyPI) < 0.11.1, ECOSYSTEM:introduced=0,fixed=0.11.1.

Q: Is there a fix for CVE-2026-87999?

Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-87999 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-87999?

Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87999 · Severity: high · CVSS 7.1 · Published 2026-09-09

Open WebUI is a platform that retrieves web content on behalf of users for features like document ingestion and web search. An authenticated user can bypass the server's internal-address protection and force it to fetch from Azure metadata endpoints or other reserved-use IP addresses, receiving the response back through the API. On deployments running in Azure, this exposes the Azure platform metadata channel that every virtual machine can reach, potentially leaking cloud credentials and configuration data.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-87999 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87999 being exploited in the wild.
How severe is CVE-2026-87999?: High severity, with a CVSS score of 7.1, published 9 September 2026.
Which products and versions are affected?: open-webui (PyPI) < 0.11.1, ECOSYSTEM:introduced=0,fixed=0.11.1.
Is there a fix for CVE-2026-87999?: Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87999 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87999?: Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

open-webui (PyPI): upgrade to 0.11.1 or later
```
pip install "open-webui>=0.11.1"
```

Technical details

The vulnerability is a server-side request forgery (SSRF) in the URL-fetching endpoints used for RAG ingestion and web search. The root cause lies in `backend/open_webui/retrieval/web/utils.py`, where address validation checked only whether an IP is "globally routable" according to Python's ipaddress library, treating that as a proxy for external reachability. However, several reserved addresses—including 168.63.129.16 (Azure platform channel), IPv4-translated ranges, and IPv6 site-local addresses—are classified as globally routable by IANA registry but are actually internal to specific platforms. Any authenticated user can POST to `/api/v1/retrieval/process/web` or `/api/v1/retrieval/process/web/search` with a crafted URL; the request passes validation, is issued by the server, and the response body is returned in the API response. This affects all versions prior to 0.11.1 when running with default settings (ENABLE_LOCAL_WEB_FETCH=false and empty WEB_FETCH_FILTER_LIST). The fix applies a default blocklist of reserved and internal-purpose ranges at both URL validation and connection time, covering redirects and DNS rebinding, with operators able to extend via WEB_FETCH_FILTER_LIST.

Affected products

open-webui open-webui < 0.11.1

Identifiers

CVE-2026-87999
GHSA-34r3-9m95-vq73
PYSEC-2026-4116

Timeline

2026-09-10: disclosed: Vulnerability advisory published
2026-09-10: patched: Fixed in version 0.11.1 via PR #27823
2026-08-30: other: Initial advisory date from GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.