CVE-2026-54021
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, several direct, index-addressed Ollama proxy routes accept a caller-supplied url_idx path parameter and use it as a raw index into the admin-configured OLLAMA_BASE_URLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the request is routed to. Any authenticated user can append an arbitrary url_idx to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends. This vulnerability is fixed in 0.9.6.
Summary dbcve.org
Open WebUI prior to 0.9.6 contains an index-based authorization bypass in Ollama proxy routes. The url_idx path parameter is used directly to index into the admin-configured OLLAMA_BASE_URLS list without validating user authorization for that specific backend. Any authenticated user can manipulate this parameter to access Ollama backends they were never authorized to reach, including internal or admin-disabled backends.
Mitigation
Upgrade to Open WebUI version 0.9.6 or later, which implements proper authorization validation on the url_idx parameter before routing requests to Ollama backends.