PT-2026-50592 · Ollama+1 · Ollama+1
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Open WebUI versions prior to 0.9.6
Description
Several direct, index-addressed Ollama proxy routes allow authenticated users to bypass backend isolation. The system accepts a caller-supplied
url idx path parameter and uses it as a raw index into the OLLAMA BASE URLS list without verifying if the user is authorized to access that specific backend. While the system validates if a user can use a requested model, it fails to validate the destination backend. This allows users to force requests to internal, higher-privilege, or admin-disabled backends, consuming restricted compute resources using the server-side API key.Affected API endpoints include:
- '/ollama/api/chat/{url idx}'
- '/ollama/api/generate/{url idx}'
- '/ollama/api/embed/{url idx}'
- '/ollama/api/embeddings/{url idx}'
- '/ollama/v1/chat/completions/{url idx}'
- '/ollama/v1/completions/{url idx}'
- '/ollama/v1/messages/{url idx}'
- '/ollama/v1/responses/{url idx}'
The issue resides in the
get ollama url() function, which skips the model-to-backend allow-list mapping when url idx is provided.Recommendations
Update to version 0.9.6.
As a temporary workaround, restrict access to the affected API endpoints or avoid using the
url idx parameter in requests until the update is applied.Exploit
Fix
DoS
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ollama
Open-Webui