OllamaHound

OllamaHound 노출된 Ollama 서버를 발견하고, 버전을 식별하며, 모델 접근을 검증하기 위한 모듈식 툴킷입니다. OllamaHound 는 공개적으로 노출된 Ollama 서버 를 발견하고, 버전을 식별하며, CVE 노출 여부를 분류 하고, 텍스트 생성이 가능한지 검증하며, 선택적으로 통제된 테스트를 위한 대화형 CLI 세션을 활성화하는 모듈식 RedTeam 지향 툴킷입니다. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@...

CVE-2026-86761 snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users,...

CVE-2026-18277 Missing Authorization in eScriptorium

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...

Open WebUI: Arena task endpoints can bypass underlying model access controls

SummaryAn authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions.The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

PYSEC-2026-3601 Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

PYSEC-2026-3602 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation SummaryOpen WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

SUSE CVE-2026-62429

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

EUVD-2026-42620

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation...

GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio: the image generators, local model runners, an...

Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]

SummaryAn internal-only bypassfilter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via FastAPI query string binding, allowing any authenticated user to append ?bypassfilter=true and bypass model access control checks to invoke admin-restricted models...

Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show Affected ComponentOllama proxy endpoints missing model access control:- backend/openwebui/routers/ollama.py lines 955-995, generatecompletion- backend/openwebui/routers/ollama.py lines 835-881, embed-...

PYSEC-2026-2754 Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show Affected Component Ollama proxy endpoints missing model access control: - backend/openwebui/routers/ollama.py lines 955-995, generatecompletion - backend/openwebui/routers/ollama.py lines 835-881, emb...

Open WebUI's responses passthrough endpoint lacks access control authorization

SummaryThe /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly to upstream LLM providers without enforcing per-model access control. While the primary chat completion endpoint generatechatcompletion checks model ownership, group membership, and...

PT-2026-59362

Base Model Routing Bypasses Access Control via Model Chaining Affected Component Model chaining via base model id: - backend/open webui/routers/models.py lines 170-214, create new model - backend/open webui/routers/models.py lines 254-308, import models - backend/open webui/main.py lines 1696-171...

PT-2026-59395

Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show Affected Component Ollama proxy endpoints missing model access control: - backend/open webui/routers/ollama.py lines 955-995, generate completion - backend/open webui/routers/ollama.py lines 835-881,...

CVE-2026-59225 Open WebUI: Arena task endpoints can bypass underlying model access controls

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The...