## Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied `url_idx` path parameter and use it as a raw index into the admin-configured `OLLAMA_BASE_URLS` list. Access control on these routes validates only whether the user may use the requested *model*, never which *backend* the request is routed to. Any authenticated user can append an arbitrary `url_idx` to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends. ## Affected endpoints All indexed Ollama routes that resolve the backend through `get_ollama_url()`: ``` POST /ollama/api/chat/{url_idx} POST /ollama/api/generate/{url_idx} POST /ollama/api/embed/{url_idx} POST /ollama/api/embeddings/{url_idx} POST /ollama/v1/chat/completions/{url_idx} POST /ollama/v1/completions/{url_idx} POST /ollama/v1/messages/{url_idx} POST /ollama/v1/responses/{url_idx} ``` ## Root cause `backend/open_webui/routers/ollama.py` — `get_ollama_url()` consults the model-to-backend allow-list (`OLLAMA_MODELS[model]["urls"]`) only when `url_idx` is omitted. When the caller supplies `url_idx`, that mapping is skipped and the value is used directly as an index: ```python async def get_ollama_url(request: Request, model: str, url_idx: Optional[int] = None): if url_idx is None: models = request.app.state.OLLAMA_MODELS if model not in models: raise HTTPException(...) url_idx = random.choice(models[model].get("urls", [])) url = request.app.state.config.OLLAMA_BASE_URLS[url_idx] # caller-controlled, no authz return url, url_idx ``` The outbound request is then sent to that backend using the backend's own configured API key. Backends an admin has disabled (`OLLAMA_API_CONFIGS["<idx>"].enable = false`) are hidden from model discovery but remain reachable through the indexed route, because the disabled state is never re-checked at request time. ## Impact A verified, non-admin user with read access to any single model can: - route requests to internal / higher-capability / restricted Ollama backends in multi-backend deployments, bypassing backend-level isolation; - reach backends the admin has explicitly disabled; - have those requests authenticated with the target backend's configured API key (the key is used server-side; it is not returned to the attacker); - consume the restricted backend's compute. There is no cross-user data disclosure and no exfiltration of the backend credential itself; the impact is unauthorized access to, and use of, restricted backend resources. ## Affected / Patched - Affected: `<= 0.9.5` - Patched: `>= 0.9.6` ## Fix 0.9.6 adds `validate_ollama_backend_idx()`, invoked on every indexed route (directly and via `get_ollama_url()`), which returns 403 for any non-admin caller-supplied `url_idx` that is not in the requested model's allowed `urls`. Because disabled backends are absent from every model's `urls`, the same check also blocks routing to disabled backends.
## Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied `url_idx` path parameter and use it as a raw index into the admin-configured `OLLAMA_BASE_URLS` list. Access control on these routes validates only whether the user may use the requested *model*, never which *backend* the request is routed to. Any authenticated user can append an arbitrary `url_idx` to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends. ## Affected endpoints All indexed Ollama routes that resolve the backend through `get_ollama_url()`: ``` POST /ollama/api/chat/{url_idx} POST /ollama/api/generate/{url_idx} POST /ollama/api/embed/{url_idx} POST /ollama/api/embeddings/{url_idx} POST /ollama/v1/chat/completions/{url_idx} POST /ollama/v1/completions/{url_idx} POST /ollama/v1/messages/{url_idx} POST /ollama/v1/responses/{url_idx} ``` ## Root cause `backend/open_webui/routers/ollama.py` — `get_ollama_url()` consults the model-to-backend allow-list (`OLLAMA_MODELS[model]["urls"]`) only when `url_idx` is omitted. When the caller supplies `url_idx`, that mapping is skipped and the value is used directly as an index: ```python async def get_ollama_url(request: Request, model: str, url_idx: Optional[int] = None): if url_idx is None: models = request.app.state.OLLAMA_MODELS if model not in models: raise HTTPException(...) url_idx = random.choice(models[model].get("urls", [])) url = request.app.state.config.OLLAMA_BASE_URLS[url_idx] # caller-controlled, no authz return url, url_idx ``` The outbound request is then sent to that backend using the backend's own configured API key. Backends an admin has disabled (`OLLAMA_API_CONFIGS["<idx>"].enable = false`) are hidden from model discovery but remain reachable through the indexed route, because the disabled state is never re-checked at request time. ## Impact A verified, non-admin user with read access to any single model can: - route requests to internal / higher-capability / restricted Ollama backends in multi-backend deployments, bypassing backend-level isolation; - reach backends the admin has explicitly disabled; - have those requests authenticated with the target backend's configured API key (the key is used server-side; it is not returned to the attacker); - consume the restricted backend's compute. There is no cross-user data disclosure and no exfiltration of the backend credential itself; the impact is unauthorized access to, and use of, restricted backend resources. ## Affected / Patched - Affected: `<= 0.9.5` - Patched: `>= 0.9.6` ## Fix 0.9.6 adds `validate_ollama_backend_idx()`, invoked on every indexed route (directly and via `get_ollama_url()`), which returns 403 for any non-admin caller-supplied `url_idx` that is not in the requested model's allowed `urls`. Because disabled backends are absent from every model's `urls`, the same check also blocks routing to disabled backends.
Update open-webui to 0.9.6 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanOpen WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter affects open-webui (pip). Severity is medium. ## Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied `url_idx` path parameter and use it as a raw index into the admin-configured `OLLAMA_BASE_URLS` list. Access control on these routes validates only whether the user may use the requested *model*, never which *backend* the request is routed to. Any authenticated user can append an arbitrary `url_idx` to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends. ## Affected endpoints All indexed Ollama routes that resolve the backend through `get_ollama_url()`: ``` POST /ollama/api/chat/{url_idx} POST /ollama/api/generate/{url_idx} POST /ollama/api/embed/{url_idx} POST /ollama/api/embeddings/{url_idx} POST /ollama/v1/chat/completions/{url_idx} POST /ollama/v1/completions/{url_idx} POST /ollama/v1/messages/{url_idx} POST /ollama/v1/responses/{url_idx} ``` ## Root cause `backend/open_webui/routers/ollama.py` — `get_ollama_url()` consults the model-to-backend allow-list (`OLLAMA_MODELS[model]["urls"]`) only when `url_idx` is omitted. When the caller supplies `url_idx`, that mapping is skipped and the value is used directly as an index: ```python async def get_ollama_url(request: Request, model: str, url_idx: Optional[int] = None): if url_idx is None: models = request.app.state.OLLAMA_MODELS if model not in models: raise HTTPException(...) url_idx = random.choice(models[model].get("urls", [])) url = request.app.state.config.OLLAMA_BASE_URLS[url_idx] # caller-controlled, no authz return url, url_idx ``` The outbound request is then sent to that backend using the backend's own configured API key. Backends an admin has disabled (`OLLAMA_API_CONFIGS["<idx>"].enable = false`) are hidden from model discovery but remain reachable through the indexed route, because the disabled state is never re-checked at request time. ## Impact A verified, non-admin user with read access to any single model can: - route requests to internal / higher-capability / restricted Ollama backends in multi-backend deployments, bypassing backend-level isolation; - reach backends the admin has explicitly disabled; - have those requests authenticated with the target backend's configured API key (the key is used server-side; it is not returned to the attacker); - consume the restricted backend's compute. There is no cross-user data disclosure and no exfiltration of the backend credential itself; the impact is unauthorized access to, and use of, restricted backend resources. ## Affected / Patched - Affected: `<= 0.9.5` - Patched: `>= 0.9.6` ## Fix 0.9.6 adds `validate_ollama_backend_idx()`, invoked on every indexed route (directly and via `get_ollama_url()`), which returns 403 for any non-admin caller-supplied `url_idx` that is not in the requested model's allowed `urls`. Because disabled backends are absent from every model's `urls`, the same check also blocks routing to disabled backends.
AI coding agents often install or upgrade packages automatically in pip. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| open-webuipip | <=0.9.5 | 0.9.6 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate open-webui to 0.9.6 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanOpen WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter affects open-webui (pip). Severity is medium. ## Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied `url_idx` path parameter and use it as a raw index into the admin-configured `OLLAMA_BASE_URLS` list. Access control on these routes validates only whether the user may use the requested *model*, never which *backend* the request is routed to. Any authenticated user can append an arbitrary `url_idx` to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends. ## Affected endpoints All indexed Ollama routes that resolve the backend through `get_ollama_url()`: ``` POST /ollama/api/chat/{url_idx} POST /ollama/api/generate/{url_idx} POST /ollama/api/embed/{url_idx} POST /ollama/api/embeddings/{url_idx} POST /ollama/v1/chat/completions/{url_idx} POST /ollama/v1/completions/{url_idx} POST /ollama/v1/messages/{url_idx} POST /ollama/v1/responses/{url_idx} ``` ## Root cause `backend/open_webui/routers/ollama.py` — `get_ollama_url()` consults the model-to-backend allow-list (`OLLAMA_MODELS[model]["urls"]`) only when `url_idx` is omitted. When the caller supplies `url_idx`, that mapping is skipped and the value is used directly as an index: ```python async def get_ollama_url(request: Request, model: str, url_idx: Optional[int] = None): if url_idx is None: models = request.app.state.OLLAMA_MODELS if model not in models: raise HTTPException(...) url_idx = random.choice(models[model].get("urls", [])) url = request.app.state.config.OLLAMA_BASE_URLS[url_idx] # caller-controlled, no authz return url, url_idx ``` The outbound request is then sent to that backend using the backend's own configured API key. Backends an admin has disabled (`OLLAMA_API_CONFIGS["<idx>"].enable = false`) are hidden from model discovery but remain reachable through the indexed route, because the disabled state is never re-checked at request time. ## Impact A verified, non-admin user with read access to any single model can: - route requests to internal / higher-capability / restricted Ollama backends in multi-backend deployments, bypassing backend-level isolation; - reach backends the admin has explicitly disabled; - have those requests authenticated with the target backend's configured API key (the key is used server-side; it is not returned to the attacker); - consume the restricted backend's compute. There is no cross-user data disclosure and no exfiltration of the backend credential itself; the impact is unauthorized access to, and use of, restricted backend resources. ## Affected / Patched - Affected: `<= 0.9.5` - Patched: `>= 0.9.6` ## Fix 0.9.6 adds `validate_ollama_backend_idx()`, invoked on every indexed route (directly and via `get_ollama_url()`), which returns 403 for any non-admin caller-supplied `url_idx` that is not in the requested model's allowed `urls`. Because disabled backends are absent from every model's `urls`, the same check also blocks routing to disabled backends.
AI coding agents often install or upgrade packages automatically in pip. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| open-webuipip | <=0.9.5 | 0.9.6 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard