CVE-2026-56400: open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with alloworigins= and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
open-webuito a version that resolves this vulnerability.Fixed in 0.3.14 - Configuration
Fix the CORS misconfiguration by removing the wildcard origin setting (allow_origins=*) and only allowing the specific trusted origins.
open-webui CORS configuration allow_origins = NOT "*" - Configuration
Ensure authenticated requests from attacker-controlled cross-site contexts cannot be made to /api/v1/functions via permissive CORS; restrict CORS to trusted origins for this endpoint.
open-webui CORS configuration Authenticated CORS access to /api/v1/functions = Disallow authenticated cross-origin requests to this endpoint
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56400?
CVE-2026-56400 has a critical severity rating of 9.
How do I fix CVE-2026-56400?
To fix CVE-2026-56400, upgrade open-webui to version 0.3.14 or later to correct the CORS misconfiguration.
What type of vulnerability is CVE-2026-56400?
CVE-2026-56400 is a remote code execution vulnerability caused by improper CORS configurations.
What software is affected by CVE-2026-56400?
The vulnerability affects open-webui versions prior to 0.3.14.
Can CVE-2026-56400 lead to data loss?
Yes, CVE-2026-56400 allows attackers to execute arbitrary code, which could result in data loss or breach.