Open WebUI CORS Misconfiguration Leading to Remote Code Execution (CVE-2026-56400)

Technical Analysis

The vulnerability stems from a misconfigured CORS policy that sets allow_origins=* while still permitting credentialed (cookie-authenticated) cross-origin requests to sensitive API endpoints, violating the CORS spec's intent that wildcard origins should not be paired with credentials. The /api/v1/functions endpoint allows privileged users to upload or modify Python-based 'functions' that execute server-side, so a forged cross-site request from an attacker's page—while an authenticated admin session cookie is active—can silently create or overwrite a function that executes attacker-supplied code on the Open WebUI host. This is a classic CSRF-to-RCE chain enabled by CORS misconfiguration rather than a memory-safety or injection bug. Successful exploitation grants the attacker code execution in the context of the Open WebUI backend process, exposing any connected LLM API keys, RAG data stores, and downstream tool-execution privileges. Because Open WebUI is commonly deployed as a front-end and orchestration layer for self-hosted LLM agents and RAG pipelines, compromise of this component can lead directly to theft of model API keys, poisoning of agent tool-call logic, and lateral movement into connected agent infrastructure.

Affected Systems

Open WebUI versions prior to 0.3.14 (all deployment modes exposing the web admin interface, including Docker and bare-metal installs with default CORS settings)

Indicators of Compromise

• No specific hashes, IPs, or domains published; indicators would be environment-specific (unexpected entries in /api/v1/functions, unfamiliar Python function code in Open WebUI admin panel, anomalous outbound requests from the Open WebUI host)

Remediation Steps

1. 1

   Upgrade Open WebUI

   Update to version 0.3.14 or later, which corrects the CORS policy for the /api/v1/functions endpoint.

2. 2

   Restrict CORS configuration

   Explicitly set allow_origins to a trusted allow-list of known frontend origins rather than using wildcard '*', and disable credentialed requests for wildcard origins.

3. 3

   Audit functions endpoint

   Review all entries under /api/v1/functions for unauthorized or unexpected code and remove any suspicious functions.

4. 4

   Enforce admin browsing hygiene

   Advise admin users to avoid browsing untrusted sites while authenticated to Open WebUI, and consider session isolation (separate browser profiles) for admin tasks.

5. 5

   Rotate exposed credentials

   Rotate any LLM provider API keys, database credentials, or tokens accessible from the Open WebUI environment in case of prior compromise.

6. 6

   Add CSRF protections

   Implement anti-CSRF tokens and same-site cookie attributes for authenticated admin endpoints as defense in depth.