Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-54021: Open WebUI lets logged-in users reach any Ollama backend

CVE-2026-54021 · published 4 months ago

Summary

In versions of Open WebUI before 0.9.6, a web address parameter could be changed by any user who is signed in. This lets the user send requests to any Ollama server that the system knows about, even those they are not supposed to use, such as internal or admin‑only servers. Upgrade to version 0.9.6 or later to stop this behavior.

What to do

Update timothy jaeryang baek open-webui to version 0.9.6.
Update openwebui open_webui to version 0.9.6 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
pip	timothy jaeryang baek	open-webui	<= 0.9.5 Fix: upgrade to 0.9.6
–	openwebui	open_webui	< 0.9.6 `cpe:2.3:a:openwebui:open_webui::::::::`

Original advisory text

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, several direct, index-addressed Ollama proxy routes accept a caller-supplied url_idx path parameter and use it as a raw index into the admin-configured OLLAMA_BASE_URLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the request is routed to. Any authenticated user can append an arbitrary url_idx to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends. This vulnerability is fixed in 0.9.6.

References

https://github.com/advisories/GHSA-9rpj-v7hf-vv2w
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54021... Vendor Advisory
https://github.com/open-webui/open-webui/security/advisories/GHSA-9rpj-v7hf-vv2w Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-54021 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published23 Jun 2026

Updated3 Nov 2026

First seen17 Jun 2026

Sources

GHSA-9rpj-v7hf-vv2w · GHSA

CVE-2026-54021 · NVD

CVE-2026-54021 · OSV

Track software like this

Free during beta