CVE-2026-56399: Open-Webui

Medium severity, CVSS 5.0. EPSS: 0.5% chance of exploitation in the next 30 days.

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.

Affected products

• Open-Webui Open-Webui: before 0.6.27 (fixed in 0.6.27)

Published 2026-06-30. Last modified 2026-07-02.