CVE-2026-56399

Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

CVSS 5.3 MEDIUMEPSS 0.3%CWE-918

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

30 jun 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Produtos afetados

open-webui · open-webui

Referências

https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774 https://github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mw https://www.vulncheck.com/advisories/open-webui-server-side-request-forgery-via-location-redirect-in-api-v1-retrieval-process-web