PYSEC-2026-2718 Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied urlidx path parameter and use it as a raw index into the admin-configured OLLAMABASEURLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the...

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

SummarySeveral direct, index-addressed Ollama proxy routes accept a caller-supplied urlidxpath parameter and use it as a raw index into the admin-configured OLLAMABASEURLSlist. Access control on these routes validates only whether the user may use therequested model, never which backend the reque...

PT-2026-59361

Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied url idx path parameter and use it as a raw index into the admin-configured OLLAMA BASE URLS list. Access control on these routes validates only whether the user may use the requested model, never which backend th...

GHSA-9RPJ-V7HF-VV2W Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied urlidx path parameter and use it as a raw index into the admin-configured OLLAMABASEURLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the...

PT-2026-50592

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description Several direct, index-addressed Ollama proxy routes allow authenticated users to bypass backend isolation. The system accepts a caller-supplied url idx path parameter and uses it as a raw index in...