CVE-2026-56400 is a high severity (CVSS 8.3) flaw in Open WebUI before 0.3.14. A permissive cross-origin policy lets a malicious website act as a visiting admin and reach the functions endpoint, which can run code on the server. The advisory lists 0.3.33 as patched.
What's affected
The record says Open WebUI before 0.3.14 is affected. The GitHub advisory (GHSA-6xcp-7mpr-m7wm), written from a GitHub Security Lab report, lists the pip package open-webui with versions below 0.3.14 affected and 0.3.33 patched. Use 0.3.33 or a later release, not merely 0.3.14.
The record describes a CORS configuration that allows any origin together with authenticated requests to the /api/v1/functions endpoint. If an administrator who is signed in visits a malicious website, that site can send requests to the Open WebUI instance as the admin.
How to check if you're exposed
Check the installed version.
pip show open-webui
For Docker, check the image tag. Anything older than 0.3.33 should be upgraded.
Also ask who can reach your instance from their browser. Instances that administrators open on the same browser they use for general web browsing carry the most risk, since the attack relies on a signed in admin visiting another site.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade Open WebUI to 0.3.33 or later, and in practice to the current release.
- Restrict allowed origins to the exact hosts that need them, if your version has a setting for it.
- Have administrators use a separate browser profile for admin sessions.
- Review the functions defined on your instance for any you did not create.
- Sign out all sessions after upgrading and rotate secrets the instance can reach.
Why it matters
The record lists CWE-613, insufficient session expiration, because the advisory also covers session validation, and the effect depends on a cross-origin policy that is far too open. The two together mean a site the admin does not trust can ride on the admin's session.
The functions feature lets an administrator add code that runs on the server. That is useful and powerful, and it is exactly why reaching it from another origin is dangerous. The vector requires a user action, which is the admin visiting a bad page. The record is not in CISA's Known Exploited Vulnerabilities catalog.
A cross-origin policy should name the sites allowed, never a wildcard on endpoints that change server behavior.
Quick check
Does an attacker need an account on the instance?
The record describes a malicious website that works when an administrator who is signed in visits it. The attacker does not need credentials of their own.
Sources
Last reviewed: 19 October 2026.
