CVE-2026-56399

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.27

Description Authenticated users can bypass server-side request forgery (SSRF) protections—a flaw where a server is tricked into making requests to an unintended location. By manipulating URL parameters with location redirect headers, attackers can access internal services and potentially execute commands using instance secrets via the '/api/v1/retrieval/process/web' endpoint.

Recommendations Update to version 0.6.27 or later. Restrict access to the '/api/v1/retrieval/process/web' endpoint to minimize the risk of exploitation.