CVE-2026-33340

The endpoint `@router.post("/api/proxy")` is accessible without any authentication (CWE-306 — Missing Authentication for Critical Function). An attacker can send an HTTP POST request to this endpoint, specifying any URL as the target, and the server will execute a GET request to the specified resource on behalf of the attacker (CWE-918 — Server-Side Request Forgery). This mechanism enables scanning of the internal network, querying services inaccessible directly from the outside, and retrieving cloud metadata such as IAM tokens from AWS or GCP services. The lack of any validation or filtering of the target URL makes the attack scope unlimited.

An attacker can gain access to internal network services, conduct reconnaissance of local infrastructure, and steal sensitive authentication credentials from cloud metadata (e.g., AWS/GCP IAM tokens), which may lead to further compromise of the cloud environment or internal infrastructure.

According to information available at the time of publication (2026-03-24), no patched version was available. Monitor the vendor's repository (https://github.com/ParisNeo/lollms-webui) and security advisory GHSA-mcwr-5469-pxj4 for updates on patch availability. Until a patch is released, it is recommended to: restrict network access to the lollms-webui interface only to trusted hosts (e.g., firewall, VPN), block access to the /api/proxy endpoint at the proxy/reverse proxy server level, and in cloud environments — restrict access to instance metadata endpoints (e.g., 169.254.169.254).

All known versions of the lollms-webui application (LoLLMs Web UI) — according to the vendor's description at the time of vulnerability publication, no patched versions existed.