CVE-2026-54021: Open WebUI Ollama proxy routes let users reach unauthorized backends via url_idx

Summary

Open WebUI, a self-hosted AI platform, prior to 0.9.6 has several direct, index-addressed Ollama proxy routes that accept a caller-supplied url_idx path parameter and use it as a raw index into the admin-configured OLLAMA_BASE_URLS list. Access control checks only whether the user may use the requested model, not which backend receives the request, so any authenticated user can route requests to Ollama backends they were never authorized to reach, including internal, higher-privilege, or admin-disabled ones.

Mitigation

Fixed in 0.9.6.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Topics

• Inference infrastructure

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News