CVE-2026-56399: Open WebUI SSRF — MEDIUM

CISO Take

Open WebUI's web-retrieval endpoint (/api/v1/retrieval/process/web) fails to fully validate redirect targets, letting any authenticated user pivot the server itself into fetching internal-only resources — and the vendor advisory flags a path to command execution via exposed instance secrets. This isn't a stranger-danger bug: it requires only a low-privileged logged-in account, no user interaction, and low attack complexity, so any tenant with self-signup or shared credentials is a viable entry point. Exploitation likelihood is currently low (EPSS 0.32%, no public PoC or Nuclei template, not in CISA KEV), which is the main reason CVSS lands at medium (5.0) despite the scope-change and secrets-exposure angle — but SSRF-to-metadata-to-RCE is a well-worn chain attackers automate quickly once a PoC surfaces. Open WebUI carries 108 other CVEs and a package risk score of 38/100, so treat this as one more data point in an already noisy dependency, not an isolated issue. Action: upgrade to Open WebUI 0.6.27+ immediately, restrict which accounts can create/edit web-retrieval sources, and egress-filter the host running Open WebUI so it cannot reach cloud metadata endpoints (169.254.169.254) or internal management ports regardless of app-level bypasses.

Sources: NVD EPSS GitHub Advisory ATLAS github.com

What is the risk?

CVSS 3.1 base score is medium (5.0, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), but the score understates real-world risk because the vendor advisory describes a path from SSRF to command execution via instance secrets — the CVSS vector only captures direct confidentiality loss, not the second-order impact of leaked credentials being reused. Exploitability is currently low in practice (EPSS 0.32%, no public exploit code, no Nuclei template, not KEV-listed), so this is not an imminent mass-exploitation risk, but the low privilege bar (any authenticated user, no admin required) and network attack vector mean insider threats, compromised low-tier accounts, or multi-tenant deployments are meaningfully exposed today. Because Open WebUI is frequently deployed with broad network access to internal LLM inference servers, vector databases, and cloud IMDS endpoints, the actual blast radius depends heavily on network segmentation rather than the application itself — deployments without egress controls should treat this as higher-than-CVSS severity.

How does the attack unfold?

Authenticated Access

Attacker obtains or already holds a low-privileged authenticated account on the target Open WebUI instance.

AML.T0012

SSRF Bypass

Attacker submits a URL to /api/v1/retrieval/process/web pointing to a server they control that issues a redirect/Location header to an internal target, bypassing the SSRF allowlist check.

AML.T0049

Internal Access & Reconnaissance

Open WebUI's server-side fetcher follows the redirect and retrieves content from internal services (cloud metadata, internal APIs) not otherwise reachable by the attacker.

AML.T0075

Secrets Exposure & Impact

Retrieved internal responses expose instance secrets or credentials, which the attacker can leverage toward command execution and further compromise per the vendor advisory.

AML.T0055

Authenticated Access

Attacker obtains or already holds a low-privileged authenticated account on the target Open WebUI instance.

AML.T0012

SSRF Bypass

Attacker submits a URL to /api/v1/retrieval/process/web pointing to a server they control that issues a redirect/Location header to an internal target, bypassing the SSRF allowlist check.

AML.T0049

Internal Access & Reconnaissance

Open WebUI's server-side fetcher follows the redirect and retrieves content from internal services (cloud metadata, internal APIs) not otherwise reachable by the attacker.

AML.T0075

Secrets Exposure & Impact

Retrieved internal responses expose instance secrets or credentials, which the attacker can leverage toward command execution and further compromise per the vendor advisory.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
148.3K 4 dependents Pushed 6d ago 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

5.0 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C Low

I None

A None

What should I do?

1 step

Patch to Open WebUI 0.6.27 or later, which fixes the SSRF-protection bypass in the web retrieval endpoint (see GHSA-82r6-c5jm-f3mw and the linked commit). Until patched, restrict or disable the web-retrieval/RAG-from-URL feature for non-admin users, and place the Open WebUI host behind egress filtering that blocks outbound access to 169.254.169.254 (cloud metadata), RFC1918 ranges, and any internal management interfaces regardless of app-layer controls. Rotate any instance secrets (API keys, DB credentials) that the Open WebUI process has access to, since the advisory explicitly calls out secrets exposure as an escalation path. For detection, monitor Open WebUI application logs and outbound proxy/firewall logs for requests to internal IP ranges or metadata endpoints originating from the web-retrieval feature, and alert on redirect-following behavior in outbound HTTP client logs if available.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Data Leakage RAG API AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0075 - Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.3 - AI system security controls

NIST AI RMF

MANAGE-4.1 - AI system risk response and monitoring

OWASP LLM Top 10

LLM07 - Insecure Plugin/Tool Design

Frequently Asked Questions

What is CVE-2026-56399?

Open WebUI's web-retrieval endpoint (/api/v1/retrieval/process/web) fails to fully validate redirect targets, letting any authenticated user pivot the server itself into fetching internal-only resources — and the vendor advisory flags a path to command execution via exposed instance secrets. This isn't a stranger-danger bug: it requires only a low-privileged logged-in account, no user interaction, and low attack complexity, so any tenant with self-signup or shared credentials is a viable entry point. Exploitation likelihood is currently low (EPSS 0.32%, no public PoC or Nuclei template, not in CISA KEV), which is the main reason CVSS lands at medium (5.0) despite the scope-change and secrets-exposure angle — but SSRF-to-metadata-to-RCE is a well-worn chain attackers automate quickly once a PoC surfaces. Open WebUI carries 108 other CVEs and a package risk score of 38/100, so treat this as one more data point in an already noisy dependency, not an isolated issue. Action: upgrade to Open WebUI 0.6.27+ immediately, restrict which accounts can create/edit web-retrieval sources, and egress-filter the host running Open WebUI so it cannot reach cloud metadata endpoints (169.254.169.254) or internal management ports regardless of app-level bypasses.

Is CVE-2026-56399 actively exploited?

No confirmed active exploitation of CVE-2026-56399 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56399?

Patch to Open WebUI 0.6.27 or later, which fixes the SSRF-protection bypass in the web retrieval endpoint (see GHSA-82r6-c5jm-f3mw and the linked commit). Until patched, restrict or disable the web-retrieval/RAG-from-URL feature for non-admin users, and place the Open WebUI host behind egress filtering that blocks outbound access to 169.254.169.254 (cloud metadata), RFC1918 ranges, and any internal management interfaces regardless of app-layer controls. Rotate any instance secrets (API keys, DB credentials) that the Open WebUI process has access to, since the advisory explicitly calls out secrets exposure as an escalation path. For detection, monitor Open WebUI application logs and outbound proxy/firewall logs for requests to internal IP ranges or metadata endpoints originating from the web-retrieval feature, and alert on redirect-following behavior in outbound HTTP client logs if available.

What systems are affected by CVE-2026-56399?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, model serving, agent frameworks.

What is the CVSS score for CVE-2026-56399?

CVE-2026-56399 has a CVSS v3.1 base score of 5.0 (MEDIUM). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesmodel servingagent frameworks

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0075 Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.3

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.

Exploitation Scenario

An attacker who has obtained (or was legitimately granted) a low-privileged Open WebUI account submits a URL to the /api/v1/retrieval/process/web endpoint pointing to an attacker-controlled server that responds with a 3xx redirect (or a Location header) to an internal target — e.g., the cloud metadata IP or an internal admin API. Because the SSRF allowlist check only validates the initial URL and not the redirect destination, Open WebUI's server-side fetcher follows the redirect and retrieves the internal resource, returning its content back into the chat/RAG context where the attacker can read it. If that internal resource yields credentials (cloud IAM role tokens, service API keys, database connection strings), the attacker uses them to authenticate directly to backend infrastructure — turning a single RAG feature bug into lateral movement across the AI stack and, per the vendor advisory, potentially into command execution using recovered instance secrets.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.