Open WebUI CVE-2026-56400

Exploitation requires all of: (1) the target Open WebUI instance running a permissive CORS policy with allow_origins=* (the insecure, non-default-secure configuration named in the description); (2) a user with admin privileges - needed because the /api/v1/functions code-registration endpoint is admin-restricted - being actively authenticated with a valid session; and (3) that admin being social-engineered into visiting an attacker-controlled website while logged in (UI:P / user interaction). Limiting factors: the attacker never authenticates directly (they ride the admin's session), so a hardened CORS allowlist, requiring admins to log out, or isolating the admin UI from untrusted browsing all break the chain. The CVSS AC:H and AT:P reflect that the specific configuration and admin-session timing are prerequisites the attacker cannot guarantee, so this is not exploitable against a default-secure or origin-restricted deployment.

Signals are mixed. The vendor-supplied CVSS 4.0 base score is 9.0 (critical) with network vector, but critically AC:H and AT:P (attack requirements present) plus UI:P - meaning exploitation is NOT trivial: it depends on a non-default insecure CORS configuration (allow_origins=*), requires an admin to visit an attacker page while logged in, and depends on browser/session conditions the attacker cannot fully control. So while impact is total (VC/VI/VA:H and subsequent-system SC/SI/SA:H reflecting root-in-container compromise), the exploitation path is conditional rather than spray-and-pray. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. It is not on CISA KEV and no POC is referenced, indicating no confirmed active or widespread exploitation. Net: a high-severity, high-impact issue for instances running the insecure CORS setting, but real-world risk is gated by that configuration and by successful social-engineering of an admin - treat as high priority for exposed/misconfigured deployments, lower for hardened ones.

An attacker crafts a malicious web page containing JavaScript that sends a credentialed cross-origin request to a target Open WebUI server's /api/v1/functions endpoint, registering a function with attacker-controlled Python. They lure a logged-in Open WebUI admin (via phishing link) to the page; because the server permits any origin with credentials, the victim's browser silently submits the request under the admin session, and the malicious code executes on the instance - as root inside the default Docker container. No public POC is referenced, and the high attack complexity means the admin must be authenticated and interact with the attacker page.