[GHSA] GHSA-34r3-9m95-vq73 (high) — Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

GHSA-34r3-9m95-vq73 Severity: high CVE: CVE-2026-87999

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

## Summary

Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking