CVE-2026-44563: Open WebUI model access bypass in Ollama proxy endpoints

Summary

Open WebUI versions prior to 0.9.0 expose the /api/generate, /api/embed, /api/embeddings and /api/show endpoints, which forward requests for any user-supplied model name to the Ollama backend. These endpoints require only an authenticated, non-pending user and check that the model exists, but never call AccessGrants.has_access(), so authenticated users can reach models they are not authorized to use.

Mitigation

Fixed in 0.9.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek