VULNERABILITY INTELLIGENCE
CVE-2026-56399
CVSS score5 MEDIUM
EPSS probability0.45%
CISA KEVNot currently listed
Published2026-06-30
Last modified2026-07-02
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Description
Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.
Weakness classification
- disclosure@vulncheck.com: CWE-918