CVE-2026-56399: Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-30 · updated 2026-07-02
Weakness: CWE-918

Description

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.

Affected products

open-webui: before 0.6.27 — fixed in 0.6.27

How to fix

Upgrade to a fixed version: open-webui 0.6.27. Check the vendor advisory for mitigations.

References

https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774
https://github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mw
https://www.vulncheck.com/advisories/open-webui-server-side-request-forgery-via-location-redirect-in-api-v1-retrieval-process-web
https://github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mw

Get alerted when CVE-2026-56399 or the next vulnerability affects your stack