Medium severity5.0NVD Advisory· Published Jun 30, 2026· Updated Jul 2, 2026

CVE-2026-56399

Description

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.

Affected products

Openwebui/Open Webuillm-fuzzy
Range: <0.6.27

Patches

Vulnerability mechanics

References

github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774nvd
github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mwnvd
www.vulncheck.com/advisories/open-webui-server-side-request-forgery-via-location-redirect-in-api-v1-retrieval-process-webnvd

News mentions

No linked articles in our index yet.

cvss	0.325
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000