Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-09T22:18:48.617Z",
  "pubdate": "2026-09-09T22:18:48.617Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Open WebUI prior to version 0.11.1, stemming from insufficient validation of destination IP addresses during web content retrieval operations.\nThe vulnerability allows an authenticated attacker to bypass internal network restrictions by coercing the application to fetch content from restricted, non-routable, or cloud-provider-specific internal infrastructure.\nBy manipulating requests to the /api/v1/retrieval/process/web and /api/v1/retrieval/process/web/search endpoints, attackers can interact with metadata services or internal management interfaces that are typically inaccessible from the public internet.\nThe primary risk involves the unauthorized exposure of sensitive internal platform data or potential interaction with cloud control planes, such as the Azure platform channel (168.63.129.16).\nExploitation requires the attacker to be authenticated to the Open WebUI instance, at which point they can leverage the backend utility functions to perform unauthorized HTTP requests on behalf of the server.\nThis vulnerability highlights a failure in input sanitization logic where reliance on standard Python address classification libraries proved insufficient for blocking privileged infrastructure IP ranges.",
  "technicalDetails": "The vulnerability is located within the backend utility logic of Open WebUI, specifically inside backend/open_webui/retrieval/web/utils.py. The application provides two API endpoints, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search, designed to process and scrape content from user-provided URLs.\nThe root cause of this SSRF is an incomplete blacklist or validation mechanism regarding target IP addresses. The implementation relied upon standard Python library checks that categorize addresses based on global routability. This classification failed to correctly identify or reject reserved internal addresses and cloud-specific management endpoints.\nSpecifically, the application logic failed to account for addresses within the Azure platform channel (e.g., 168.63.129.16) and other reserved ranges that, while technically non-routable on the public internet, are reachable by the backend server when hosted in an Azure environment.\nThe attack flow begins with an authenticated user submitting a crafted request to the retrieval endpoints. By providing a target IP address that bypasses the existing, flawed filter, the attacker forces the backend to initiate an outbound request. Because the validation logic mistakenly flags these malicious targets as acceptable, the application performs the GET request to the restricted resource.\nThe backend server, acting as a proxy, retrieves the content from the internal endpoint and returns the result to the authenticated user. This allows the attacker to exfiltrate information from internal services that the application server is authorized to access, such as cloud metadata services, which often do not require authentication beyond being located within the provider's network.\nThe impact is significant, as it permits lateral movement or information gathering within the internal cloud environment or local network segment. By interacting with the Azure platform channel, an attacker could potentially gain insight into the instance's identity, security configuration, or other sensitive platform-specific metadata that is not meant to be exposed via web retrieval utilities.\nThe vulnerability affects all versions of Open WebUI prior to 0.11.1. It is fundamentally an issue of trusting user-provided input after insufficient validation against a blacklist that failed to encompass all reserved and internal-only network segments."
}