CVE-2026-33340 - Vulnerability Analysis

Overview

LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication.

Severity & Score

Impact

Attackers can access internal services, scan local networks, or exfiltrate sensitive cloud metadata, potentially leading to data exposure and further compromise.

Mitigation

Update to a patched version once available or apply mitigations to restrict server-side requests.

References

• https://github.com/ParisNeo/lollms-webui/blob/8c5dcef63d847bb3d027ec74915d8fe4afd3014e/lollms/server/endpoints/lollms_apps.py#L443-L450
• https://github.com/ParisNeo/lollms-webui/security/advisories/GHSA-mcwr-5469-pxj4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner