Skip to content

Update env-configuration.mdx #1016

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Classic298 merged 1 commit into from
Jan 16, 2026
Merged

Update env-configuration.mdx #1016

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion docs/getting-started/env-configuration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2997,9 +2997,22 @@ Strictly return in JSON format:

- Type: `bool`
- Default: `False`
- Description: Enables or disables local web fetch for RAG.
- Description: Controls whether RAG web fetch operations can access URLs that resolve to private/local network IP addresses.
- Persistence: This environment variable is a `PersistentConfig` variable.

When disabled (default), Open WebUI blocks web fetch requests to URLs that resolve to private IP addresses, including:

- IPv4 private ranges (`10.x.x.x`, `172.16.x.x`-`172.31.x.x`, `192.168.x.x`, `127.x.x.x`)
- IPv6 private ranges

This is a **Server-Side Request Forgery (SSRF) protection**. Without this safeguard, a malicious user could provide URLs that appear external but resolve to internal addresses, potentially exposing internal services, cloud metadata endpoints, or other sensitive resources.

:::warning

Only enable this setting if you need to fetch content from internal network resources (e.g., an internal wiki or intranet) **and** you trust all users with access to your Open WebUI instance. Enabling this in a multi-tenant or public-facing deployment introduces significant security risk.

:::

### Google Drive

#### `ENABLE_GOOGLE_DRIVE_INTEGRATION`
Expand Down