CVE-2026-109296
4.3MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-639
Impact
Authenticated users can query disabled model provider backends, allowing them to enumerate connections, read backend version strings, and trigger backend requests using server-configured API keys. An attacker only needs basic user-level access to the Open WebUI instance.
Root cause
A missing authorization check permits users to bypass backend disabled states by specifying an explicit backend index in path segments or query parameters on listing routes.
Affected systems
Open WebUI versions prior to 0.11.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade Open WebUI to version 0.11.4 or later. If updating immediately is not possible, remove sensitive API keys and connection URLs from disabled model backends entirely instead of just disabling them.
$ docker pull ghcr.io/open-webui/open-webui:0.11.4AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.