CVE-2026-56400: Open WebUI CORS misconfig + CSRF

CISO Take

Open WebUI before 0.3.14 sets its CORS policy to allow_origins=*, so any attacker-controlled website can send authenticated cross-origin requests to the /api/v1/functions endpoint — a feature explicitly designed to execute arbitrary Python on the server. If an admin with an active session simply visits a malicious page, the attacker inherits that session cross-site and can register or trigger a malicious "function," achieving full remote code execution with no credential theft required. This matters because open-webui is one of the most widely deployed self-hosted front ends for local and API-backed LLMs, and its admin/function surface controls the underlying host, not just the chat interface — a compromise here can pivot into model configs, connected API keys (OpenAI, Anthropic, etc.), and any backend infrastructure the instance can reach. There's no CISA KEV listing, no published EPSS score, and no public exploit or Nuclei template yet, so this looks pre-exploitation rather than actively weaponized, but the CVSS 8.3, network attack vector, and full confidentiality/integrity/availability impact still warrant prompt patching. Upgrade to open-webui >= 0.3.14 now, restrict CORS to explicit trusted origins if you must self-manage the config, and until patched avoid having admin accounts browse untrusted sites in the same browser session used to manage the instance.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High severity (CVSS 8.3) despite a high attack complexity and required user interaction, because privileges required is none from the attacker's perspective — they only need an admin to load a page while authenticated. The scope-changed rating (S:C) reflects that the vulnerability in the web layer (CORS policy) enables impact beyond it (arbitrary code execution on the host). Mitigating factors: no KEV listing, no EPSS score published, no known public exploit or scanner template, and the requirement for admin-level victim interaction narrows the practical attack surface compared to unauthenticated network-exploitable bugs. Given open-webui's broad adoption as a self-hosted LLM UI and its history of 132 other CVEs in the same package, this should be treated as high priority to patch even absent confirmed in-the-wild exploitation.

How does the attack unfold?

Initial Access / Lure

Attacker delivers a link or hosts a page that an authenticated open-webui admin visits while their admin session is active.

AML.T0078

Cross-Origin Exploitation

The malicious page's JavaScript sends an authenticated cross-origin request to /api/v1/functions, which the CORS misconfiguration (allow_origins=*) permits.

AML.T0049

Code Execution

The forged request creates or invokes a function containing attacker-supplied Python, executing arbitrary code on the open-webui server.

AML.T0050

Impact

Attacker gains full compromise of the open-webui host, including access to connected LLM API keys, conversation data, and any reachable backend infrastructure.

Initial Access / Lure

Attacker delivers a link or hosts a page that an authenticated open-webui admin visits while their admin session is active.

AML.T0078

Cross-Origin Exploitation

The malicious page's JavaScript sends an authenticated cross-origin request to /api/v1/functions, which the CORS misconfiguration (allow_origins=*) permits.

AML.T0049

Code Execution

The forged request creates or invokes a function containing attacker-supplied Python, executing arbitrary code on the open-webui server.

AML.T0050

Impact

Attacker gains full compromise of the open-webui host, including access to connected LLM API keys, conversation data, and any reachable backend infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
152.6K 3 dependents Pushed 2d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Changed

C High

I High

A High

What should I do?

1 step

1) Upgrade to open-webui >= 0.3.14, which fixes the CORS/session-validation issue per the GHSA-6xcp-7mpr-m7wm advisory. 2) If immediate upgrade isn't possible, explicitly restrict CORS_ALLOW_ORIGIN to a known, trusted origin list rather than the wildcard default — never run allow_origins=* on an instance with a functions/admin surface. 3) Advise admins to avoid browsing untrusted websites or clicking unsolicited links while authenticated to the open-webui admin panel, and consider session-scoped browser profiles for admin access. 4) Review installed "functions" for unexpected or unauthorized additions as an indicator of prior compromise. 5) Detection: monitor for unexpected requests to /api/v1/functions from unusual Origin/Referer headers, and audit admin session activity logs for anomalous timing correlated with outbound link clicks.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Social Engineering Plugin Framework AML.T0011.003 - Malicious Link AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0078 - Drive-by Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-56400?

Open WebUI before 0.3.14 sets its CORS policy to allow_origins=*, so any attacker-controlled website can send authenticated cross-origin requests to the /api/v1/functions endpoint — a feature explicitly designed to execute arbitrary Python on the server. If an admin with an active session simply visits a malicious page, the attacker inherits that session cross-site and can register or trigger a malicious "function," achieving full remote code execution with no credential theft required. This matters because open-webui is one of the most widely deployed self-hosted front ends for local and API-backed LLMs, and its admin/function surface controls the underlying host, not just the chat interface — a compromise here can pivot into model configs, connected API keys (OpenAI, Anthropic, etc.), and any backend infrastructure the instance can reach. There's no CISA KEV listing, no published EPSS score, and no public exploit or Nuclei template yet, so this looks pre-exploitation rather than actively weaponized, but the CVSS 8.3, network attack vector, and full confidentiality/integrity/availability impact still warrant prompt patching. Upgrade to open-webui >= 0.3.14 now, restrict CORS to explicit trusted origins if you must self-manage the config, and until patched avoid having admin accounts browse untrusted sites in the same browser session used to manage the instance.

Is CVE-2026-56400 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-56400, increasing the risk of exploitation.

How to fix CVE-2026-56400?

1) Upgrade to open-webui >= 0.3.14, which fixes the CORS/session-validation issue per the GHSA-6xcp-7mpr-m7wm advisory. 2) If immediate upgrade isn't possible, explicitly restrict CORS_ALLOW_ORIGIN to a known, trusted origin list rather than the wildcard default — never run allow_origins=* on an instance with a functions/admin surface. 3) Advise admins to avoid browsing untrusted websites or clicking unsolicited links while authenticated to the open-webui admin panel, and consider session-scoped browser profiles for admin access. 4) Review installed "functions" for unexpected or unauthorized additions as an indicator of prior compromise. 5) Detection: monitor for unexpected requests to /api/v1/functions from unusual Origin/Referer headers, and audit admin session activity logs for anomalous timing correlated with outbound link clicks.

What systems are affected by CVE-2026-56400?

This vulnerability affects the following AI/ML architecture patterns: model serving, agent frameworks, self-hosted LLM UI/gateway.

What is the CVSS score for CVE-2026-56400?

CVE-2026-56400 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

model servingagent frameworksself-hosted LLM UI/gateway

MITRE ATLAS Techniques

AML.T0011.003 Malicious Link

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0078 Drive-by Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.

Exploitation Scenario

An attacker identifies an organization running a self-hosted open-webui instance (e.g., via Shodan/fingerprinting or social engineering) and crafts a webpage containing JavaScript that issues a cross-origin fetch() request to the target's /api/v1/functions endpoint. The attacker delivers this page to an admin via phishing, a compromised ad, or a malicious link in a forum/Slack message relevant to the AI/ML community. When the admin — while still logged into open-webui in another tab — visits the page, the browser's CORS policy allows the cross-site request to succeed with the admin's session cookies attached, since the server accepts requests from any origin. The malicious request installs or invokes a function containing attacker-supplied Python, executing arbitrary code on the open-webui host and giving the attacker a foothold to exfiltrate API keys, pivot to connected LLM backends, or establish persistence.

Weaknesses (CWE)

CWE-613 Insufficient Session Expiration Primary CWE-613 Insufficient Session Expiration

CWE-613 — Insufficient Session Expiration: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."