Which versions of Open WebUI are affected by CVE-2026-56400?

Open WebUI versions before 0.3.33, a self-hosted LLM interface widely deployed in research and enterprise settings, contains a critical remote code execution vulnerability (CVE-2026-56400, CVSS 9.0)…. A patch is available.

How to fix or mitigate CVE-2026-56400?

Within 24 hours, inventory all Open WebUI deployments and audit their CORS configuration; immediately restrict any instance configured with allow_origins=* (the default setting) to specific trusted domains or disable CORS if not required, and review API logs for suspicious cross-origin requests to /api/v1/functions. Within 7 days, deploy Open WebUI 0.3.33 or later to all affected instances and re-verify CORS settings after the upgrade. Within 30 days, implement application configuration management to prevent default insecure settings, conduct a complete security audit of all LLM platform deployments, and establish network access controls limiting administrator activities to trusted networks only.

Open WebUI CVE-2026-56400

Q: What is the CVSS score of CVE-2026-56400?

CVE-2026-56400 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44629 CRITICAL

Insufficient Session Expiration (CWE-613)

2026-07-15 VulnCheck

GHSA-m5hr-9f92-qvh9

RCE Open Webui

9.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-delivered but AC:H because it needs the allow_origins=* misconfig and an admin session; PR:N as the attacker is unauthenticated, UI:R for the admin visit, S:C and C/I/A:H for root code execution and container compromise.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 12:28 vuln.today

Analysis Generated

Jul 15, 2026 - 12:28 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

CRITICAL 9.0

DescriptionCVE.org

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.

AnalysisAI

Remote code execution in Open WebUI (self-hosted LLM interface) before the fixed 0.3.33 release allows attackers to hijack an authenticated admin session through a CORS misconfiguration. When an instance is deployed with allow_origins=* and an authenticated admin visits an attacker-controlled website, the malicious page can issue authenticated cross-origin requests to the /api/v1/functions endpoint and register attacker-supplied Python code, achieving code execution - and because the container runs as root by default, full container compromise. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the flaw is documented in a GitHub Security Lab advisory (GHSL-2024-174/175) and reported by VulnCheck.

Technical ContextAI

Open WebUI is a popular self-hosted web front-end for running local and remote large language models. The root cause is CWE-613 (Insufficient Session Expiration) combined with a CORS misconfiguration: multiple FastAPI routers (backend/apps/webui/main.py, audio, images, rag and others) were configured with a permissive Access-Control-Allow-Origin policy (allow_origins=* together with credentialed requests). This lets any origin make authenticated cross-site requests using the victim's existing session. The /api/v1/functions endpoint, accessible to admin accounts, permits registering 'functions' that contain executable Python, so an attacker who can drive an admin's browser into calling that endpoint gains arbitrary code execution. The single affected CPE is cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: upgrade to Open WebUI 0.3.33 or later, which corrects the CORS and session validation handling (see the GitHub Security Advisory GHSA-6xcp-7mpr-m7wm). Until patched, restrict cross-origin exposure by not running with allow_origins=* - set an explicit allowlist of trusted origins via the CORS_ALLOW_ORIGIN configuration so arbitrary attacker sites cannot make credentialed requests; the trade-off is that legitimate additional front-end origins must be enumerated. Additionally, reduce blast radius by not running the container as root (drop privileges / use a non-root user), which limits the 'complete container compromise' outcome even if the CORS request succeeds. Encourage admins to log out of Open WebUI when not in use and avoid browsing untrusted sites in the same session, and place the admin interface behind a VPN or network ACL so only trusted networks can reach it. Reference: https://www.vulncheck.com/advisories/open-webui-remote-code-execution-via-cors-misconfiguration-and-session-validation.