Summary
CVE-2026-56400 is a critical CORS (Cross-Origin Resource Sharing) misconfiguration vulnerability in Open WebUI versions prior to 0.3.14, carrying a CVSS 4.0 score of 9.0. When allow_origins is set to the wildcard *, an attacker can craft malicious cross-site requests from an attacker-controlled website that, when visited by an authenticated admin, result in arbitrary code execution on the Open WebUI instance. Because Open WebUI commonly runs as root within Docker containers by default, successful exploitation yields full container compromise.
Technical details
- Root cause: Open WebUI’s default CORS policy sets
CORS_ALLOW_ORIGIN=*, permitting requests from any origin. When this misconfiguration is combined with authenticated sessions, the/api/v1/functionsendpoint accepts and executes cross-origin requests without proper origin validation. - Trigger conditions: Exploitation requires (1) the target instance to be running with the default or explicitly permissive
allow_origins=*CORS setting, and (2) an authenticated admin user to visit an attacker-controlled web page — achievable through phishing or social engineering. - Attack vector: Fully network-based (AV:N); the attacker hosts a malicious webpage that silently issues a crafted cross-origin request to the victim’s Open WebUI instance, leveraging the admin’s active browser session.
- Impact: Arbitrary code execution on the Open WebUI server. Since Open WebUI typically runs as root in Docker’s default configuration, a successful attack results in complete compromise of the container, including full confidentiality, integrity, and availability impact on both the vulnerable system and systems it can reach.
Affected software
- Open WebUI – all versions before 0.3.14
Severity
- CVSS 4.0 Base Score: 9.0 (Critical)
- Vector String:
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Mitigation and recommended actions
- Immediate – upgrade: Update Open WebUI to version 0.3.14 or later, which addresses the CORS misconfiguration on the
/api/v1/functionsendpoint. - CORS hardening: Explicitly restrict the
CORS_ALLOW_ORIGINenvironment variable to your specific trusted domain(s) rather than using the wildcard default. Per the Open WebUI hardening documentation, set:CORS_ALLOW_ORIGIN=https://your.domain.com(multiple origins can be separated with semicolons). - Network-level controls: If immediate patching is not possible, restrict access to the Open WebUI instance using a firewall, VPN, or reverse proxy so only trusted users can reach the interface.
- Minimize admin exposure: Limit the number of admin-privileged accounts and apply strict phishing awareness controls to reduce the likelihood of an admin visiting a malicious page.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.