CVE-2026-56399 | Open WebUI before 0.6.27 contains a server-side request forg… | CVSS 5.0 MEDIUM

Description

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.

Metadata

CVE ID: CVE-2026-56399
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-21 12:37 UTC
Published: 2026-06-30 22:08 UTC
Last updated: 2026-06-30 22:08 UTC
Primary CWE: CWE-918
Server-Side Request Forgery (SSRF)
Vendor / Product: open-webui / open-webui
Sources: cve.org · NVD

Severity & Metrics

5.0 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
open-webui	open-webui	—	0 < 0.6.27, 0.6.27

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	Server-Side Request Forgery (SSRF)

CVSS scores (2)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
5.0	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References (3)

GitHub Security Advisory (GHSA-82r6-c5jm-f3mw) https://github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mw
https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774 https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774
VulnCheck Advisory: Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web https://www.vulncheck.com/advisories/open-webui-server-side-request-forgery-via-location-redirect-in-api-v1-retrieval-process-web