CVE-2026-109296 Overview
CVE-2026-109296 is a missing authorization vulnerability [CWE-639] affecting Open WebUI versions prior to 0.11.4. Authenticated users can reach disabled model provider backends by supplying an explicit backend index on Ollama and OpenAI-compatible listing routes. The index can be passed as a path segment or query parameter, causing the application to issue requests that carry configured API keys. Attackers can then read version strings and enumerate connection details for backends the administrator intentionally disabled.
Critical Impact
Authenticated attackers can bypass administrative controls on disabled model backends, triggering outbound requests that leak backend version strings and connection metadata while exercising configured provider API keys.
Affected Products
- Open WebUI versions before 0.11.4
- Deployments exposing Ollama listing routes
- Deployments exposing OpenAI-compatible listing routes
Discovery Timeline
- 2026-10-12 - CVE-2026-109296 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109296
Vulnerability Analysis
The vulnerability is a server-side authorization gap on model listing endpoints in Open WebUI. The application exposes routes that enumerate configured Ollama and OpenAI-compatible connections. Administrators can disable individual backends through configuration. The affected routes accept an explicit backend index from the authenticated caller. This index is accepted either as a path segment or a query parameter.
The handler dispatches the request against the indexed backend without first checking whether that backend is enabled for the caller. As a result, an authenticated user who should only reach enabled backends can address disabled ones directly. The server performs outbound requests to the disabled backend using the stored API keys. Responses expose version strings and allow enumeration of configured connections.
The weakness maps to CWE-639, Authorization Bypass Through User-Controlled Key. The caller supplies the identifier that selects the resource, and the application fails to validate that the resource is permitted.
Root Cause
The routing logic trusts the client-supplied backend index as a lookup key. It does not re-check the enabled state of the selected backend before invoking it. Access control is enforced on the overall route but not on the specific backend indexed by the request.
Attack Vector
An authenticated user issues a request to an Ollama or OpenAI-compatible listing route. The attacker appends the backend index to the path or supplies it as a query parameter. Open WebUI dispatches the request to the selected backend, including the configured API key, and returns version data and connection details. See the GitHub Security Advisory GHSA-hm62-64q2-6gxw for route specifics.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109296
Indicators of Compromise
- Requests to Ollama or OpenAI-compatible listing routes that include a numeric backend index as a path segment or index query parameter.
- Outbound traffic from Open WebUI to provider endpoints that administrators had marked as disabled.
- Repeated enumeration patterns where a single authenticated session iterates sequential backend indices.
Detection Strategies
- Inspect Open WebUI access logs for listing routes carrying explicit backend indices and correlate with the administrative enabled/disabled state.
- Alert when authenticated non-admin accounts touch model provider listing endpoints with index parameters.
- Baseline outbound API calls from Open WebUI per backend and flag calls to backends currently disabled in configuration.
Monitoring Recommendations
- Capture application logs with user identity, route, parameters, and selected backend index.
- Monitor API key usage telemetry at upstream providers for calls originating from Open WebUI against disabled connections.
- Track version string responses returned to clients, which can indicate successful probing of disabled backends.
How to Mitigate CVE-2026-109296
Immediate Actions Required
- Upgrade Open WebUI to version 0.11.4 or later across all deployments.
- Rotate API keys configured for any Ollama or OpenAI-compatible backend that was reachable before patching.
- Audit account access to Open WebUI and revoke sessions for users that are not required to use model listing routes.
Patch Information
Open WebUI resolves the authorization gap in version 0.11.4. The fix is tracked in the project's advisory GHSA-hm62-64q2-6gxw and the VulnCheck Advisory for Open WebUI. Apply the upstream release rather than relying on configuration changes alone.
Workarounds
- Restrict network reachability of Open WebUI listing routes to trusted administrative users until the upgrade is applied.
- Remove credentials for disabled backends from configuration so an index-based call cannot carry a valid API key.
- Place Open WebUI behind a reverse proxy that denies requests containing backend index parameters on model listing routes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
