SEPTEMBER 11, 2026
Live Feed
Back to database
Case File

CVE-2026-56400

HIGH · CVSS 8.3 EPSS 0.35% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-15 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

The vulnerability arises from a cross-origin resource sharing misconfiguration in open-webui versions prior to 0.3.14, which permits arbitrary origins due to the use of allow_origins=*. This flaw allows attackers to execute arbitrary code on the affected instance by sending malicious cross-site requests when an admin user accesses compromised websites. Organizations using open-webui should prioritize remediation to protect against potential exploitation and unauthorized access.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-56400
Severity
HIGH
CVSS
8.3
EPSS
0.35%

Original NVD Description

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.

Related CVEs

Other vulnerabilities affecting the same vendor(s)