CVE-2026-54021: Open WebUI Authentication Bypass via Ollama Backend Routing

Technical summary

The vulnerability exists in Ollama proxy routes within Open WebUI that accept a url_idx path parameter. This parameter is used as a direct index into the admin-configured OLLAMA_BASE_URLS list without proper validation. While access control checks verify whether a user is authorized to use a specific model, they do not enforce which backend Ollama instance that request should be routed to. An authenticated attacker can craft requests with an arbitrary url_idx value to force routing to unintended backends, bypassing the intended segmentation between different Ollama instances. The flaw is classified under CWE-863 (Incorrect Authorization).

Business impact

This vulnerability enables authenticated users to access AI models and capabilities beyond their intended scope, potentially exposing sensitive use cases, proprietary model configurations, or internal development instances. In multi-tenant or departmentally segmented deployments, users could access backends reserved for administrators or other business units. The ability to reach disabled or experimental backends also increases the risk of triggering unvetted model behavior or accessing systems undergoing security review or remediation.

Affected systems

Open WebUI versions prior to 0.9.6 are affected. The vulnerability only impacts instances that (1) use Ollama as a backend, (2) configure multiple OLLAMA_BASE_URLS entries with intended access segregation, and (3) have multiple authenticated users. Single-user deployments or those with only one configured Ollama backend are not practically exploitable, though the code flaw still exists.

Exploitability

Exploitability is straightforward for any authenticated user. The attack requires only HTTP requests with a modified url_idx parameter; no special tools, credentials beyond a basic user account, or user interaction are needed. The low complexity and authenticated-only requirement reflect the CVSS 3.1 score of 6.3 (Medium severity). External attack surface is present for any Open WebUI instance accessible over the network, though an attacker must first obtain valid login credentials.

Remediation

Upgrade Open WebUI to version 0.9.6 or later. This version implements proper access control enforcement that validates both the model authorization and the target backend. Organizations should verify the upgrade path with the Open WebUI project documentation and confirm that no configuration changes are required post-upgrade. For deployments unable to patch immediately, consider restricting network access to Open WebUI to trusted networks or requiring additional authentication layers (e.g., VPN, reverse proxy authentication).

Patch guidance

The fix is available in Open WebUI version 0.9.6 and later releases. Review the project's official release notes and changelog to confirm the security fix is included in the version you deploy. Test the upgrade in a non-production environment first, particularly if you rely on multi-backend routing for segregation. Verify that after upgrading, users can still access only the backends and models they are authorized for, and that disabled or restricted backends remain inaccessible.

Detection guidance

Monitor Open WebUI logs for unusual or repeated requests with varying url_idx parameter values, particularly to backends that should be off-limits to standard users. Authentication logs showing successful access to disabled backends or unexpected backend routing may indicate exploitation. If using a reverse proxy or API gateway in front of Open WebUI, inspect proxy logs for requests with suspicious path parameters. Consider enabling verbose logging in Open WebUI to capture backend routing decisions and compare them against user entitlements.

Why prioritize this

Although the CVSS score is Medium (6.3), this vulnerability should be prioritized for patching in multi-user deployments where backend segmentation is relied upon for compliance, data isolation, or role-based access control. The ease of exploitation (no special tools, only authenticated access) and the likelihood of rapid discovery (the flaw is direct and parameter-based) warrant swift remediation. Organizations using Open WebUI in production should prioritize this fix within standard security patch cycles.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a network-accessible vulnerability requiring low privilege (authenticated user) and low complexity, with low impact to confidentiality, integrity, and availability. The score does not account for organizational context—environments where backend segregation is critical for compliance or data protection should treat this with higher urgency than the base score alone suggests. The vulnerability is not yet tracked in the CISA Known Exploited Vulnerabilities catalog, but the simplicity of the attack makes it likely to be discovered and exploited if deployments lag on patching.

Frequently asked questions