GHSA-v6qf-75pr-p96m: Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]

Summary

GHSA-v6qf-75pr-p96m affects Open WebUI. The bypass_filter parameter in the generate_chat_completion handlers in routers/openai.py and routers/ollama.py is bound from the query string by FastAPI, so an authenticated user can append ?bypass_filter=true to /openai/chat/completions or /ollama/api/chat. This skips the model access control check, letting any authenticated user invoke admin-restricted models through the server's configured connections.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Topics

• Inference infrastructure

Related items

• MediumGitLab critical patches include one for a bug that allows code execution by unauthenticated usersSimilar attack · CSO Online
• HighCVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerSimilar attack · AWS Security Bulletins
• CriticalCVE-2026-114612: LiteLLM admin access via forged credential replay enables MCP stdio commandsSimilar attack · NVD/CVE Database
• LowThird-party evaluators found vulnerabilities in OpenAI monitoring system during test pilotSimilar attack · CNBC Technology
• InfoSomeone hacked the Switch 2 by using an old game and AISimilar attack · The Verge (AI)