CVE-2026-54021: Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Summary

Several direct, index-addressed Ollama proxy routes accept a caller-supplied urlidx path parameter and use it as a raw index into the admin-configured OLLAMABASEURLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the request is routed to. Any authenticated user can append an arbitrary urlidx to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends.

Affected endpoints

All indexed Ollama routes that resolve the backend through getollamaurl():

POST /ollama/api/chat/{urlidx} POST /ollama/api/generate/{urlidx} POST /ollama/api/embed/{urlidx} POST /ollama/api/embeddings/{urlidx} POST /ollama/v1/chat/completions/{urlidx} POST /ollama/v1/completions/{urlidx} POST /ollama/v1/messages/{urlidx} POST /ollama/v1/responses/{urlidx}

Root cause

backend/openwebui/routers/ollama.py — getollamaurl() consults the model-to-backend allow-list (OLLAMAMODELS[model]["urls"]) only when urlidx is omitted. When the caller supplies urlidx, that mapping is skipped and the value is used directly as an index:

python async def getollamaurl(request: Request, model: str, urlidx: Optional[int] = None): if urlidx is None: models = request.app.state.OLLAMAMODELS if model not in models: raise HTTPException(...) urlidx = random.choice(models[model].get("urls", [])) url = request.app.state.config.OLLAMABASEURLS[urlidx] # caller-controlled, no authz return url, urlidx

The outbound request is then sent to that backend using the backend's own configured API key. Backends an admin has disabled (OLLAMAAPICONFIGS["<idx>"].enable = false) are hidden from model discovery but remain reachable through the indexed route, because the disabled state is never re-checked at request time.

Impact

A verified, non-admin user with read access to any single model can: - route requests to internal / higher-capability / restricted Ollama backends in multi-backend deployments, bypassing backend-level isolation; - reach backends the admin has explicitly disabled; - have those requests authenticated with the target backend's configured API key (the key is used server-side; it is not returned to the attacker); - consume the restricted backend's compute.

There is no cross-user data disclosure and no exfiltration of the backend credential itself; the impact is unauthorized access to, and use of, restricted backend resources.

Affected / Patched

- Affected: <= 0.9.5 - Patched: >= 0.9.6

Fix

0.9.6 adds validateollamabackendidx(), invoked on every indexed route (directly and via getollamaurl()), which returns 403 for any non-admin caller-supplied urlidx that is not in the requested model's allowed urls. Because disabled backends are absent from every model's urls, the same check also blocks routing to disabled backends.