Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Base Model Routing Bypasses Access Control via Model Chaining Affected Component Model chaining via basemodelid: - backend/openwebui/routers/models.py lines 170-214, createnewmodel - backend/openwebui/routers/models.py lines 254-308, importmodels - backend/openwebui/main.py lines 1696-1711, base...

PT-2026-39273

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description The '/responses' endpoint in the OpenAI router allows any authenticated user to forward requests to upstream LLM providers without enforcing per-model access control. While the generate chat...

PT-2026-39280

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.0 Description Four Ollama proxy endpoints accept any model name from the user and forward the request to the Ollama backend without verifying if the user is authorized to access that model. While these endpoint...

PT-2026-37165

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0 Description Missing authorization allows authenticated Panel users to access site, user, and role information without proper permission gating. This occurs because permission settings...

EUVD-2025-209209

Juju: Read All Controller Logs From Compromised Workload...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization debug log endpoint in the API server. An attacker can access sensitive log data belonging to any entity across any model by compromising a workload machine under the controller. Remediation A fix was pushed into...

Juju 安全漏洞

Juju is a canonical Juju open-source application orchestration engine. Vulnerabilities existed in versions of Juju between 2.9 and 2.9.56, as well as in versions between 3.6 and 3.6.19. These vulnerabilities stemmed from the possibility that compromised workload machines could read any log file o...

PT-2026-41183

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.11 Description An internal-only bypass filter parameter is exposed on the '/openai/chat/completions' and '/ollama/api/chat' HTTP endpoints due to FastAPI query string binding. This allows any authenticated user...

CVE-2026-26013

A flaw was found in LangChain. The ChatOpenAI.getnumtokensfrommessages method fetches arbitrary imageurl values without validation when computing token counts for vision-enabled models. This issue allows an attacker to cause Server-Side Request Forgery SSRF by providing malicious image URLs in us...

Securing Cloud AI and LLMs with TotalAI for Visibility, Risk Context and Control

As enterprises accelerate AI adoption, large language models LLMs hosted on public cloud platforms are quickly becoming the norm due to their simplified access and pricing model. Cloud-native services like AWS Bedrock, Azure AI Foundry, and Google Vertex AI offer powerful, pay-as-you-go access to...

PT-2025-12034 · Unknown · Lunary-Ai/Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.5.0 Description: The issue is related to improper privilege management in the models.ts file, which allows users with viewer roles to modify models owned by others. The "PATCH" endpoint for models lacks appropriate...

CVE-2024-7557 Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai

A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access...