Open WebUI: missing authorization lets any logged-in user reach disabled model backends by index

Impact

Open WebUI's model listing routes accept an explicit backend index as a path segment or query parameter and do not check whether that backend is enabled or whether the caller may use it. Any authenticated user - including a self-registered one on an instance with open signup - can enumerate the configured provider connections and make the server issue requests that carry the operator's configured API keys to backends that were deliberately switched off. For a GPU cluster that fronts its inference fleet with Open WebUI, this exposes the internal topology (which Ollama and OpenAI-compatible endpoints exist, their version strings) and lets a tenant spend credentials on paid upstream providers that were taken out of service. The record describes confidentiality impact only; it does not claim key material is returned to the attacker.

Who can reach it

Any authenticated Open WebUI user over the network, by appending a backend index to the Ollama or OpenAI-compatible listing routes. No admin role needed.

What to do

Upgrade to Open WebUI 0.11.4 or later and restart the service - a container or daemon restart per instance, no node drain. If an upgrade cannot be scheduled, remove disabled provider connections and their API keys from the configuration rather than leaving them switched off, and rotate any keys held in connections that untrusted users could have driven.

References

Related entries

• BentoML OpenLLM 0.6.30 (async_run_command in src/openllm/common.py): A model repository directory name flows unescapedCVE-2026-15035 · BentoML OpenLLM 0.6.30 (async_run_command in src/openllm/common.py)Medium
• JupyterHub: unauthenticated logins write unbounded usernames to the log, exhausting storageCVE-2026-54338 · JupyterHub form-based login authenticators (failed-login logging)Medium
• vLLM: malformed JSON to the OpenAI-compatible endpoints returns server paths and versionsCVE-2026-73555 · vLLM OpenAI-compatible API server (validation_exception_handler, sanitize_message)Medium
• vLLM: attacker-supplied structured-output regex pins a CPU core and stalls the engine pathCVE-2026-73556 · vLLM structured outputs, lm-format-enforcer backend (structured_outputs.regex)Medium
• vLLM: integer overflow in the activation CUDA kernel leaks another batched request's outputCVE-2026-73558 · vLLM CUDA activation kernels (act_and_mul_kernel, activation_kernels.cu)Medium
• vLLM (DeepStream video backend, VideoMediaIO backend selection): A performance feature merged past two existingNCVD-2026-044-vllm-deepstream-video-backend-vi · vLLM (DeepStream video backend, VideoMediaIO backend selection)Medium