CVE-2026-56399

Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

CVSS 5.3 MEDIUMEPSS 0.3%CWE-918

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

30 jun 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Productos afectados

open-webui · open-webui

Referencias

https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774 https://github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mw https://www.vulncheck.com/advisories/open-webui-server-side-request-forgery-via-location-redirect-in-api-v1-retrieval-process-web