Unrated severityNVD Advisory· Published Jun 30, 2026· Updated Jul 1, 2026
Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web
CVE-2026-56399
Description
Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.
Affected products
1- Range: <0.6.27
Patches
Vulnerability mechanics
References
3- github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774mitrepatch
- github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mwmitrevendor-advisory
- www.vulncheck.com/advisories/open-webui-server-side-request-forgery-via-location-redirect-in-api-v1-retrieval-process-webmitrethird-party-advisory
News mentions
0No linked articles in our index yet.