https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 02:06:05 +0000 https://vulnerability.circl.lu/vuln/cve-2026-54021 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, several direct, index-addressed Ollama proxy routes accept a caller-supplied url_idx path parameter and use it as a raw index into the admin-configured OLLAMA_BASE_URLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the request is routed to. Any authenticated user can append an arbitrary url_idx to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends. This vulnerability is fixed in 0.9.6.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, several direct, index-addressed Ollama proxy routes accept a caller-supplied url_idx path parameter and use it as a raw index into the admin-configured OLLAMA_BASE_URLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the request is routed to. Any authenticated user can append an arbitrary url_idx to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends. This vulnerability is fixed in 0.9.6.</p> https://vulnerability.circl.lu/vuln/cve-2026-54021 https://vulnerability.circl.lu/vuln/pysec-2026-2718 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Several direct, index-addressed Ollama proxy routes accept a caller-supplied `url_idx` path parameter and use it as a raw index into the admin-configured `OLLAMA_BASE_URLS` list. Access control on these routes validates only whether the user may use the requested *model*, never which *backend* the request is routed to. Any authenticated user can append an arbitrary `url_idx` to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends.</p> <p>## Affected endpoints</p> <p>All indexed Ollama routes that resolve the backend through `get_ollama_url()`:</p> <p>``` POST /ollama/api/chat/{url_idx} POST /ollama/api/generate/{url_idx} POST /ollama/api/embed/{url_idx} POST /ollama/api/embeddings/{url_idx} POST /ollama/v1/chat/completions/{url_idx} POST /ollama/v1/completions/{url_idx} POST /ollama/v1/messages/{url_idx} POST /ollama/v1/responses/{url_idx} ```</p> <p>## Root cause</p> <p>`backend/open_webui/routers/ollama.py` — `get_ollama_url()` consults the model-to-backend allow-list (`OLLAMA_MODELS[model][&#34;urls&#34;]`) only when `url_idx` is omitted. When the caller supplies `url_idx`, that mapping is skipped and the value is used directly as an index:</p> <p>```python async def get_ollama_url(request: Request, model: str, url_idx: Optional[int] = None): if url_idx is None: models = request.app.state.OLLAMA_MODELS if model not in models: raise HTTPException(...) url_idx = ra…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Several direct, index-addressed Ollama proxy routes accept a caller-supplied `url_idx` path parameter and use it as a raw index into the admin-configured `OLLAMA_BASE_URLS` list. Access control on these routes validates only whether the user may use the requested *model*, never which *backend* the request is routed to. Any authenticated user can append an arbitrary `url_idx` to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends.</p> <p>## Affected endpoints</p> <p>All indexed Ollama routes that resolve the backend through `get_ollama_url()`:</p> <p>``` POST /ollama/api/chat/{url_idx} POST /ollama/api/generate/{url_idx} POST /ollama/api/embed/{url_idx} POST /ollama/api/embeddings/{url_idx} POST /ollama/v1/chat/completions/{url_idx} POST /ollama/v1/completions/{url_idx} POST /ollama/v1/messages/{url_idx} POST /ollama/v1/responses/{url_idx} ```</p> <p>## Root cause</p> <p>`backend/open_webui/routers/ollama.py` — `get_ollama_url()` consults the model-to-backend allow-list (`OLLAMA_MODELS[model][&#34;urls&#34;]`) only when `url_idx` is omitted. When the caller supplies `url_idx`, that mapping is skipped and the value is used directly as an index:</p> <p>```python async def get_ollama_url(request: Request, model: str, url_idx: Optional[int] = None): if url_idx is None: models = request.app.state.OLLAMA_MODELS if model not in models: raise HTTPException(...) url_idx = ra…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2718