CVE-2026-109296 in Open WebUI
Summary
by MITRE • 10/12/2026
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in versions of Open WebUI prior to 0.11.4 represents a critical failure in access control logic within the application's backend routing mechanism. This flaw is classified as an Authorization Bypass using a Reference or Key Identifier, aligning with CWE-285 and corresponding to the ATT&CK technique T1078 Valid Accounts when combined with credential theft implications. The core issue stems from insufficient validation of user permissions against disabled model provider configurations. While the application correctly restricts access to these providers through its primary interface by marking them as inactive or unavailable, it fails to enforce this restriction at the API endpoint level where backend indexing occurs.
Authenticated users can exploit this discrepancy by directly manipulating HTTP requests sent to Ollama and OpenAI-compatible listing routes. By supplying an explicit backend index either as a path segment or within query parameters, attackers bypass the standard UI-based access controls that would normally prevent interaction with disabled services. This mechanism allows the application to route requests to backends that have been explicitly disabled by administrators for security, cost, or operational reasons. The vulnerability does not require privilege escalation beyond existing authentication; rather, it exploits a logical gap in how state changes are propagated from configuration settings to runtime request handling logic.
The operational impact of this vulnerability is significant due to the sensitive nature of the data exposed through these endpoints. When an attacker successfully triggers a request using a disabled backend index, the application proceeds to execute requests carrying configured API keys associated with that provider. This exposure allows adversaries to read version strings from remote services and enumerate available connections without detection by standard access logs designed for authorized traffic patterns. The leakage of API keys poses a severe risk as these credentials often grant broad permissions within third-party AI service ecosystems, potentially leading to unauthorized usage charges, data exfiltration via the connected models, or further compromise if those keys are reused across other services.
Furthermore, the ability to enumerate connections and version strings aids attackers in reconnaissance efforts, allowing them to fingerprint specific model versions and infrastructure setups. This information can be leveraged for subsequent attacks tailored to known vulnerabilities in older model server software or to optimize prompt injection strategies against specific model architectures. The lack of proper authorization checks means that any authenticated user, regardless of their role or intended scope within the Open WebUI instance, can interact with restricted resources, violating the principle of least privilege and undermining administrative security policies.
Mitigation for this vulnerability requires immediate upgrading to version 0.11.4 or later where these access control checks have been reinforced at the API layer. Administrators should ensure that all backend configurations are strictly validated against user permissions before any request is processed by the underlying provider client libraries. In environments where upgrading is not immediately feasible, network-level controls such as firewall rules restricting outbound traffic to disabled endpoints can provide a temporary compensating measure. Additionally, rotating exposed API keys and auditing access logs for anomalous requests targeting non-standard indices are critical steps in incident response following exploitation of this flaw.