CVE-2026-109296: falha de média gravidade em open-webui
Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
open-webui · open-webuiCVEs relacionadas — open-webui
No mesmo produto, das mais perigosas para as menos.
CVE-2025-64496HIGHOpen WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE EventsEPSS 7.2%CVE-2026-34222HIGHOpen WebUI has Broken Access Control in Tool ValvesEPSS 5.1%CVE-2025-65958HIGHOpen WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/webEPSS 4.7%CVE-2026-28788HIGHOpen WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwriteEPSS 3.0%CVE-2026-44551CRITICALOpen WebUI: LDAP Empty Password Authentication BypassEPSS 1.5%CVE-2026-45397MEDIUMOpen WebUI: Unauthenticated RAG Configuration DisclosureEPSS 0.8%