CVE-2026-56399

MediumCVSS 5.0/10Last modified Jul 2, 2026

Description

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
open-webuiopen-webui< 0.6.27

References

Timeline

Published
Jun 30, 2026
Last modified
Jul 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-56406.3A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /adCVE-2026-564009.6open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and autheCVE-2026-564026.5NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder CVE-2026-564036.9libexpat before 2.8.2 has an integer overflow in storeAtts.CVE-2026-564046.9libexpat before 2.8.2 has an integer overflow in addBinding.CVE-2026-564056.9libexpat before 2.8.2 has an integer overflow in getAttributeId.CVE-2026-564066.9libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.CVE-2026-564076.9libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.CVE-2026-564086.9libexpat before 2.8.2 has an integer overflow in copyString.CVE-2026-564096.5xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.CVE-2026-56416.3A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /admin/uCVE-2026-564106.9xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56399: Medium severity, CVSS 5.0 | Vulnix