CVE-2026-56400: Open Webui CORS RCE Vulnerability

CVE-2026-56400 Overview

CVE-2026-56400 is a Cross-Site Request Forgery (CSRF) vulnerability in Open WebUI versions prior to 0.3.14. The flaw stems from a Cross-Origin Resource Sharing (CORS) misconfiguration that sets allow_origins=* while permitting authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on an Open WebUI instance by luring an authenticated administrator to visit a malicious website. The attacker-controlled page issues cross-site requests that register malicious Python functions on the target instance. The issue is tracked under CWE-613: Insufficient Session Expiration and documented in the GitHub Security Advisory GHSA-6xcp-7mpr-m7wm.

Critical Impact
An authenticated admin visiting an attacker-controlled page can be silently forced to execute arbitrary Python code on the Open WebUI server, resulting in full instance compromise.

Affected Products

Open WebUI versions prior to 0.3.14
Deployments exposing the /api/v1/functions endpoint to browser-authenticated administrators
Instances configured with allow_origins=* and credentialed CORS requests

Discovery Timeline

2026-07-15 - CVE-2026-56400 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-56400

Vulnerability Analysis

Open WebUI is a self-hosted web interface for large language model backends. It exposes an administrative API endpoint at /api/v1/functions that allows administrators to register server-side Python functions used by the model runtime. The endpoint requires an authenticated admin session but relies solely on session cookies for authorization.

The application's CORS policy sets allow_origins=* while accepting credentialed requests. This combination allows any origin to trigger authenticated API calls when an administrator's browser holds an active session. There is no CSRF token, SameSite cookie enforcement, or origin allowlist protecting the state-changing endpoint.

Because registered functions execute Python code on the server host, an attacker who registers a function achieves arbitrary code execution within the Open WebUI process context.

Root Cause

The root cause is a combination of two design defects. First, the CORS middleware permits arbitrary origins to send credentialed requests, defeating the browser same-origin protections that would normally block cross-site API calls. Second, the /api/v1/functions endpoint accepts state-changing POST requests without verifying request origin, referer, or a synchronizer token. Session cookies alone are treated as sufficient authorization.

Attack Vector

Exploitation requires an authenticated Open WebUI administrator to load an attacker-controlled webpage. The malicious page issues a cross-origin fetch call with credentials: 'include' to the victim instance's /api/v1/functions endpoint. The request body contains a Python function definition. Because the CORS policy accepts the request and the endpoint accepts the session cookie, the payload is registered and later executed by the Open WebUI runtime. Attack complexity is elevated because the attacker must know or guess the internal URL of the target instance and must convince an admin to visit the trap page. Refer to the VulnCheck advisory for additional technical detail.

Detection Methods for CVE-2026-56400

Indicators of Compromise

Unexpected entries in the Open WebUI functions registry, particularly Python functions containing subprocess, socket, or file system calls.
POST requests to /api/v1/functions with an Origin or Referer header outside the organization's trusted domains.
Outbound network connections initiated by the Open WebUI process to previously unseen hosts.
Admin session activity originating from browsers immediately after visits to unfamiliar external URLs.

Detection Strategies

Inspect reverse proxy or web server access logs for POST requests to /api/v1/functions where the Origin header does not match the deployment's canonical hostname.
Compare the current list of registered functions against a known-good baseline and alert on additions made outside change windows.
Monitor the Open WebUI container or host for child processes spawned by the application runtime, which are unusual under normal operation.

Monitoring Recommendations

Forward Open WebUI application and access logs to a centralized logging platform for retention and correlation with admin browser telemetry.
Enable audit logging for administrator actions and alert on function registration events.
Track process creation and outbound network events on the host running Open WebUI to identify post-exploitation activity.

How to Mitigate CVE-2026-56400

Immediate Actions Required

Upgrade Open WebUI to version 0.3.14 or later on all instances.
Audit the functions registry for unauthorized entries and remove any that cannot be attributed to a legitimate change.
Rotate administrator credentials and invalidate active sessions after patching.
Restrict network access to the Open WebUI management interface using a VPN or IP allowlist until upgraded.

Patch Information

The fix is available in Open WebUI 0.3.14, which restricts the CORS allow_origins configuration and hardens session validation on state-changing endpoints. See the GitHub Security Advisory GHSA-6xcp-7mpr-m7wm for release details.

Workarounds

Place Open WebUI behind a reverse proxy that enforces an explicit Origin header allowlist for requests to /api/v1/functions.
Configure administrator session cookies with SameSite=Strict and Secure attributes at the proxy layer.
Instruct administrators to use a dedicated browser profile that is not used for general web browsing while a session is active.

bash

# Example nginx reverse proxy snippet restricting Origin on the functions endpoint
location /api/v1/functions {
    if ($http_origin !~* ^https://openwebui\.example\.com$) {
        return 403;
    }
    proxy_pass http://openwebui_backend;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}