CVE-2026-109296: Open WebUI missing authz exposes

CISO Take

Open WebUI before 0.11.4 fails to check authorization when a user supplies an explicit backend index on Ollama and OpenAI-compatible listing routes, so any logged-in user can reach model provider backends that admins had disabled. Requests sent to those backends carry the configured API keys, and the attacker can also read version strings and enumerate connections. The severity is medium (CVSS 4.3) and the impact is limited to low confidentiality. EPSS data is not yet available, the CVE is not in CISA KEV, and no public exploit or Nuclei template exists, so near-term mass exploitation looks unlikely. The main concern is multi-user deployments where low-privilege accounts exist, such as shared enterprise or team instances. Upgrade to Open WebUI 0.11.4 or later, then review which backends you have disabled on purpose and rotate any provider keys if you suspect misuse.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Overall risk is low to medium. Exploitation is trivial for any authenticated user: it is network reachable, needs low complexity, and requires no user interaction. The impact is limited to low confidentiality, with no integrity or availability effect. Risk rises in multi-tenant or shared deployments where admins disabled certain backends, for example an expensive or sensitive provider, on the assumption that disabling would block all access. No exploitation in the wild, no KEV listing and no EPSS score are available, so likelihood is currently low.

How does the attack unfold?

Initial Access

The attacker logs in to Open WebUI with a valid low-privilege account.

AML.T0012

Exploitation

The attacker sends a listing request with an explicit backend index in the path or query to bypass the disabled-backend check.

AML.T0049

Discovery

The attacker enumerates connections and reads version strings from the backends.

AML.T0075

Impact

Requests carrying configured API keys reach backends that were meant to be off, exposing infrastructure details and enabling follow-on abuse.

Initial Access

The attacker logs in to Open WebUI with a valid low-privilege account.

AML.T0012

Exploitation

The attacker sends a listing request with an explicit backend index in the path or query to bypass the disabled-backend check.

AML.T0049

Discovery

The attacker enumerates connections and reads version strings from the backends.

AML.T0075

Impact

Requests carrying configured API keys reach backends that were meant to be off, exposing infrastructure details and enabling follow-on abuse.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

6 steps

Upgrade Open WebUI to 0.11.4 or later.
Until you can patch, remove disabled backend entries and their API keys from the configuration instead of only toggling them off.
Restrict account creation and limit access to trusted users, and put the instance behind SSO or a VPN.
Rotate API keys for any provider connection that was disabled but still configured, if low-privilege users had access.
Detect abuse by reviewing reverse proxy and application logs for Ollama and OpenAI listing routes that include an explicit numeric index in the path or query string, especially from non-admin accounts.
Check provider-side logs for unexpected requests from the Open WebUI host to disabled endpoints.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAPIFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Risk treatment and response to unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-109296?

Open WebUI before 0.11.4 fails to check authorization when a user supplies an explicit backend index on Ollama and OpenAI-compatible listing routes, so any logged-in user can reach model provider backends that admins had disabled. Requests sent to those backends carry the configured API keys, and the attacker can also read version strings and enumerate connections. The severity is medium (CVSS 4.3) and the impact is limited to low confidentiality. EPSS data is not yet available, the CVE is not in CISA KEV, and no public exploit or Nuclei template exists, so near-term mass exploitation looks unlikely. The main concern is multi-user deployments where low-privilege accounts exist, such as shared enterprise or team instances. Upgrade to Open WebUI 0.11.4 or later, then review which backends you have disabled on purpose and rotate any provider keys if you suspect misuse.

Is CVE-2026-109296 actively exploited?

No confirmed active exploitation of CVE-2026-109296 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109296?

1. Upgrade Open WebUI to 0.11.4 or later. 2. Until you can patch, remove disabled backend entries and their API keys from the configuration instead of only toggling them off. 3. Restrict account creation and limit access to trusted users, and put the instance behind SSO or a VPN. 4. Rotate API keys for any provider connection that was disabled but still configured, if low-privilege users had access. 5. Detect abuse by reviewing reverse proxy and application logs for Ollama and OpenAI listing routes that include an explicit numeric index in the path or query string, especially from non-admin accounts. 6. Check provider-side logs for unexpected requests from the Open WebUI host to disabled endpoints.

What systems are affected by CVE-2026-109296?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Model serving gateways, Multi-provider LLM routing.

What is the CVSS score for CVE-2026-109296?

CVE-2026-109296 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsModel serving gatewaysMulti-provider LLM routing

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0075Cloud Service Discovery

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.

Exploitation Scenario

An attacker holds a low-privilege account on a company's shared Open WebUI instance, either as an employee or through open sign-up. The admin has disabled an OpenAI-compatible backend that points to a costly or restricted provider. The attacker calls the Ollama or OpenAI listing route with the index of the disabled backend as a path segment or query parameter. Open WebUI sends the request to that backend with its configured API key and returns the response. The attacker then reads version strings, enumerates connections, and maps the internal inference infrastructure for later attacks.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key CWE-862Missing Authorization

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.