CVE-2026-56400
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The vulnerability in open-webui before version 0.3.14 is due to a misconfigured CORS policy that allows arbitrary origins (allow_origins=*) and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the open-webui instance by crafting malicious cross-site requests when an admin user visits attacker-controlled websites.
Risk Assessment
The risk is that an attacker can remotely execute code on the open-webui server, potentially leading to full compromise of the instance, data theft, or further attacks on the infrastructure.
Recommendation
Immediately upgrade open-webui to version 0.3.14 or later and review the CORS configuration to restrict allowed origins to trusted domains.
Other vulnerabilities in open-webui
See all- CVE-2026-45350High
In Open WebUI prior to version 0.8.6, there is a vulnerability in the chat completion API that allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access.
- CVE-2026-45338High
In Open WebUI prior to version 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the _process_picture_url() function, allowing an attacker to force the server to make HTTP requests to internal resources.
- CVE-2026-45315High
Open WebUI prior to version 0.9.3 has a vulnerability that allows audio files with HTML extensions to be uploaded, potentially leading to the execution of malicious code in users' browsers. A user with the appropriate permissions can trick others into opening a malicious link.
- CVE-2026-45303High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.5 allowed for script injection and execution through the HTML rendering view. The chat content was embedded in an iFrame with sandbox restrictions that were largely ineffective.
- CVE-2026-45301High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.3.16 had a missing permission check in files related to API endpoints. This allowed any authenticated user to list, access, and delete every file uploaded by other users.
- CVE-2026-44570High
In Open WebUI prior to version 0.6.19, there were inconsistencies in authorization controls surrounding the memories API, allowing standard users to delete, restore, and view the contents of other users' memories.
- CVE-2026-44569High
In Open WebUI prior to version 0.6.19, there is an IDOR vulnerability in the channels message management system that allows authenticated users to modify or delete any message within channels they have access to. The issue arises from a lack of message ownership validation in the message update and delete endpoints.
- CVE-2026-44567High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.1.124 did not properly validate whether a user has an authorized role. By default, when new user sign-ups are enabled, the user role is set to 'pending', requiring administrator intervention to assign the appropriate role.
- CVE-2026-44566High
Open WebUI is an artificial intelligence platform that prior to version 0.1.124 did not validate or sanitize file names uploaded by users. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended upload directory.
- CVE-2026-44565High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.10 did not validate or sanitize file names when uploading audio files. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended uploads directory.
Original NVD description (English source)
open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.