CVE-2026-33340
CriticalSummary
A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in the LoLLMs web user interface. It allows unauthenticated attackers to force the server into making arbitrary GET requests, potentially leading to access to internal services and leakage of sensitive data.
Risk Assessment
This vulnerability poses a significant risk to organizations by allowing attackers to access internal resources and scan local networks. It may lead to the leakage of sensitive information, such as cloud IAM tokens.
Recommendation
It is recommended to update the system to a version that addresses this vulnerability as soon as possible and to monitor network traffic for potential attack attempts.
Original NVD description (English source)
LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. The `@router.post("/api/proxy")` endpoint allows unauthenticated attackers to force the server into making arbitrary GET requests. This can be exploited to access internal services, scan local networks, or exfiltrate sensitive cloud metadata (e.g., AWS/GCP IAM tokens). As of time of publication, no known patched versions are available.