{"data":{"id":"aef24f01-fa83-4ef2-818c-64c40ce8a4b8","title":"CVE-2026-54021: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6…","summary":"Open WebUI, a self-hosted AI platform, prior to 0.9.6 has several direct, index-addressed Ollama proxy routes that accept a caller-supplied url_idx path parameter and use it as a raw index into the admin-configured OLLAMA_BASE_URLS list. Access control checks only whether the user may use the requested model, not which backend receives the request, so any authenticated user can route requests to Ollama backends they were never authorized to reach, including internal, higher-privilege, or admin-disabled ones.","solution":"Fixed in 0.9.6.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54021","publishedAt":"2026-06-23T18:18:07.370Z","cveId":"CVE-2026-54021","cweIds":["CWE-863"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["open-webui@<= 0.9.5 (fixed: 0.9.6)"],"affectedPackageNames":["open-webui"],"affectedPackageRefs":["pypi:open-webui"],"affectedVendors":[],"affectedVendorsRaw":["Open WebUI","Ollama"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Open WebUI Ollama proxy routes let users reach unauthorized backends via url_idx","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00283,"epssCheckedAt":"2026-11-10T00:11:22.330Z","kevDateAdded":null,"advisoryAliases":["GHSA-9rpj-v7hf-vv2w"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:33.836Z","patchAvailable":true,"disclosureDate":"2026-06-23T18:18:07.370Z","fixReleasedAt":"2026-06-01T22:03:27.641Z","daysToFix":-22,"fixCheckedAt":"2026-10-29T21:33:54.962Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"open-webui","fixedVersion":"0.9.6","matchedVersion":"0.9.6","fixReleasedAt":"2026-06-01T22:03:27.641Z","daysToFix":-22,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:33:54.813Z"}]}}