CVE-2026-33340: LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint
LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of lollms-webui. The @router.post("/api/proxy") endpoint allows unauthenticated attackers to force the server into making arbitrary GET requests. This can be exploited to access internal services, scan local networks, or exfiltrate sensitive cloud metadata (e.g., AWS/GCP IAM tokens). As of time of publication, no known patched versions are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33340?
CVE-2026-33340 is classified as a critical vulnerability due to its unauthenticated Server-Side Request Forgery (SSRF) risk.
How do I fix CVE-2026-33340?
To fix CVE-2026-33340, update the LoLLMs WEBUI to the latest patched version where the SSRF vulnerability has been addressed.
What is the impact of CVE-2026-33340?
The impact of CVE-2026-33340 allows attackers to access and manipulate server resources through crafted requests.
Which versions of LoLLMs WEBUI are affected by CVE-2026-33340?
All known existing versions of LoLLMs WEBUI are affected by CVE-2026-33340.
Can CVE-2026-33340 be exploited remotely?
Yes, CVE-2026-33340 can be exploited remotely due to its unauthenticated nature.