Openwebui Open Webui — CVE-2026-56400 (Critical)

Date Jul 15, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Openwebui · Open Webui

CVE CVE-2026-56400

Critical vendor advisory CVE-2026-56400

Summary

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 8.3) in Openwebui Open Webui. Patch or mitigate promptly. EPSS percentile: 20%.

Operator check

Review CVE-2026-56400 in your asset inventory. Apply patches per vendor guidance and verify Open Webui is not exposed. CVSS score: 8.3. EPSS probability: 0.3%; percentile: 20%.

Sources

NVD — CVE-2026-56400 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed