10 matches found
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
Summary When the vLLM API receives a malformed request e.g., invalid JSON or missing required fields, FastAPI raises a Pydantic RequestValidationError. The validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts this exception to a string via strexc, which includes the...
BIT-AIRFLOW-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id
Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...
PYSEC-2026-435 Open WebUI has an LDAP Empty Password Authentication Bypass
LDAP Empty Password Authentication Bypass Affected Component LDAP authentication endpoint: - backend/openwebui/routers/auths.py lines 468-477, user bind with empty password - backend/openwebui/models/auths.py lines 58-60, LdapForm model Affected Versions Current main branch commit 6fdd19bf1 and...
Fulcrum-OSINT-monitor
FULCRUM — Architecture Technique v3.1 Vue d'ensemble FULC...
GHSA-3R75-XC34-5F44 Crawlee for Python: SSRF via sitemap-derived URLs
Overview - Vulnerability type: Blind SSRF - Affected components: src/crawlee/utils/sitemap.py, src/crawlee/utils/robots.py, src/crawlee/requestloaders/sitemaprequestloader.py, and all built-in HTTP clients. - Trigger: an attacker-controlled sitemap or robots.txt containing a URL that points to an...
CVE-2026-44550
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, FolderForm uses modelconfig = ConfigDictextra='allow', which permits arbitrary fields to pass through Pydantic validation and be included in modeldumpexcludeunset=True. In...
CVE-2026-44550: Missing Authorization
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, FolderForm uses modelconfig = ConfigDictextra='allow', which permits arbitrary fields to pass through Pydantic validation and be included in modeldumpexcludeunset=True. In...
ormar 安全漏洞
ORMar is a Python ORM library developed by Collerek’s individual developers. Versions of Ormar prior to 0.23.0 contain security vulnerabilities. These vulnerabilities stem from Pydantic validation bypasses in the model constructor. This allows unvalidated users to bypass field validations by...
CVE-2026-27953: Improperly Controlled Modification of Dynamically-Determined Object Attributes
ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...
