CVE-2026-56400: 
Open WebUI vulnerability analysis and mitigation

CVE-2026-56400 is a CORS misconfiguration vulnerability in open-webui that enables remote code execution (RCE) via crafted cross-site requests. Affecting open-webui versions before 0.3.14, the flaw arises from the application setting allow_origins=["*"] with allow_credentials=True across multiple routers, allowing arbitrary websites to make authenticated cross-site requests to the /api/v1/functions endpoint. It was discovered by GitHub Security Lab researchers (GHSL-2024-174, GHSL-2024-175), published on July 15, 2026, and patched in version 0.3.14. The vulnerability carries a CVSS v3.1 score of 9.6 (Critical) and a CVSS v4.0 score of 9.0 (Critical) (GitHub Advisory, GHSL Advisory).

The root cause is a CORS misconfiguration (related to CWE-613: Insufficient Session Expiration, and broadly to improper access control) present in multiple FastAPI router files including backend/apps/webui/main.py, backend/apps/audio/main.py, backend/apps/images/main.py, backend/apps/rag/main.py, backend/apps/openai/main.py, backend/apps/ollama/main.py, and backend/main.py. Each sets CORSMiddleware with allow_origins=["*"] and allow_credentials=True, which causes the FastAPI middleware to reflect the requesting origin and permit credentialed cross-origin requests from any domain. A compounding issue (GHSL-2024-175) is that open-webui fails to invalidate session cookies on logout, meaning an attacker can exploit the CORS flaw even if the admin has previously logged out but not closed their browser. Exploitation requires an admin user to visit an attacker-controlled webpage, which then silently issues authenticated fetch() requests to /api/v1/functions/create and /api/v1/functions/id/{id}/toggle to inject and execute arbitrary Python code on the server (GHSL Advisory, VulnCheck Advisory).

Successful exploitation results in arbitrary code execution on the open-webui server instance with the privileges of the running process. Because open-webui runs as root in its default Docker container configuration, a successful attack leads to complete container compromise, including full confidentiality, integrity, and availability impact on both the vulnerable system and any subsequent systems accessible from the container. An attacker could exfiltrate sensitive data (AI model configurations, user data, API keys), modify system files, or pivot to other services within the container network (GHSL Advisory, GitHub Advisory).

1. Reconnaissance: Identify open-webui instances (versions before 0.3.14) accessible via the network, particularly those exposed to the internet or internal networks where admin users browse.
2. Set up attacker-controlled website: Host a malicious webpage (e.g., attacker.com) containing JavaScript that will execute cross-origin requests against the target open-webui instance.
3. Lure admin user: Social-engineer an admin user into visiting the attacker-controlled webpage while they have an active (or recently used) open-webui session in their browser.
4. Trigger cross-origin function creation: Upon user interaction (e.g., a click), the malicious JavaScript executes a fetch() POST request with credentials: 'include' to http://<openwebui-host>/api/v1/functions/create, submitting a JSON payload containing a malicious Python function body (e.g., code that runs subprocess.getoutput('whoami') and writes output to /tmp/whoami.txt).
5. Activate the malicious function: A second fetch() POST request is sent to http://<openwebui-host>/api/v1/functions/id/<filter_id>/toggle with credentials: 'include' to enable the newly created function, triggering server-side execution of the injected Python code.
6. Achieve RCE: The injected code executes as root within the Docker container, enabling arbitrary command execution, reverse shell establishment, data exfiltration, or further lateral movement within the container environment.
7. Leverage session persistence (optional): If the admin has previously logged out without closing their browser, the session cookie invalidation failure (GHSL-2024-175) may allow the attack to succeed even without an active login session (GHSL Advisory).

• Network: Unexpected cross-origin HTTP POST requests to /api/v1/functions/create or /api/v1/functions/id/<id>/toggle originating from browser sessions with Origin headers pointing to unknown or external domains; outbound connections from the open-webui container to unfamiliar external IP addresses.
• Logs: open-webui access logs showing POST requests to /api/v1/functions/create and /api/v1/functions/id/*/toggle with unusual or encoded Content-Type: application/json payloads; log entries showing function creation by admin accounts at unexpected times.
• File System: Unexpected files created in /tmp/ (e.g., /tmp/whoami.txt or other attacker-chosen output files); new or modified Python function files within the open-webui functions directory; unexpected scripts or binaries dropped in the container filesystem.
• Process: Unusual child processes spawned by the open-webui Python process, such as subprocess calls to /bin/sh, curl, wget, python3, or network utilities; unexpected outbound network connections initiated by the open-webui process (GHSL Advisory).

Upgrade open-webui to version 0.3.14 or later, which addresses the CORS misconfiguration. As a configuration-based workaround, replace the wildcard allow_origins=["*"] setting with an explicit allowlist of trusted origins in all affected router files, and ensure allow_credentials=True is only used alongside specific, trusted origins (not wildcards). Additionally, implement proper session cookie invalidation on logout to mitigate the compounding session persistence issue (GHSL-2024-175). Administrators should also consider restricting admin user access to untrusted external websites and deploying network-level controls to limit cross-origin access to the open-webui instance (GHSL Advisory, GitHub Advisory).

The vulnerability was discovered and reported by GitHub Security Lab researcher Kevin Stubbings (@Kwstubbs) under the coordinated disclosure identifiers GHSL-2024-174 and GHSL-2024-175. VulnCheck published an advisory highlighting the combined CORS misconfiguration and session validation bypass as a notable RCE vector in AI-adjacent tooling. The open-webui project, which has over 146,000 GitHub stars, represents a high-profile target given its widespread use as a self-hosted AI interface, amplifying community interest in the disclosure (GHSL Advisory, VulnCheck Advisory).