CVE-2026-56400

🗓️ 15 Jul 2026 11:25:31Reported by VulnCheckType

open-webui before 0.3.14 is described as vulnerable to a cross-origin resource sharing misconfiguration that allows arbitrary origins (allow_origins=*) and authenticated requests to the /api/v1/functions endpoint. The result is remote code executi...

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-56400	15 Jul 202611:25	–	attackerkb
Circl	CVE-2026-56400	15 Jul 202612:38	–	circl
Cvelist	CVE-2026-56400 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation	15 Jul 202611:25	–	cvelist
EUVD	EUVD-2026-44629	15 Jul 202611:25	–	euvd
NVD	CVE-2026-56400	15 Jul 202612:18	–	nvd
Positive Technologies	PT-2026-60120	15 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-56400 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation	15 Jul 202611:25	–	vulnrichment

Vulners

CNA

Node

open-webui open-webuiRange0–0.3.14

[
  {
    "vendor": "open-webui",
    "product": "open-webui",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:pypi/open-webui",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "0.3.14"
      },
      {
        "version": "0.3.14",
        "status": "unaffected",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/open-webui-remote-code-execution-via-cors-misconfiguration-and-session-validation
github	www.github.com/open-webui/open-webui/security/advisories/GHSA-6xcp-7mpr-m7wm

15 Jul 2026 20:15Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.18.3

CVSS 49

SSVC

CWE-613