CVE-20XX-?

Openwebui Open Webui CVEs.

Published CVEs affecting Openwebui Open Webui, ranked by exploit odds.

1 CVEs · updated 2026-11-06 06:52 UTC

Reset all
  1. CVE-2026-56400

    open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.

    Code execution Openwebui Open Webui

    9.0 CRITICAL 0.5% exploit odds Fix listed

All CVEs affecting Openwebui Open Webui that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.