PT-2026-27456 · Unknown · Lollms-Webui

Regaan · Published 2026-03-24 · Updated 2026-04-14 · CVE-2026-33340

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LoLLMs WEBUI (affected versions not specified)

Description LoLLMs WEBUI, the web user interface for Lord of Large Language and Multi modal Systems, contains a Server-Side Request Forgery (SSRF) issue. An unauthenticated attacker can exploit this to force the server to make arbitrary GET requests via the /api/proxy endpoint. This could allow access to internal services, scanning of local networks, and potential exfiltration of sensitive cloud metadata, such as AWS or GCP IAM tokens.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Missing Authentication

Weakness Enumeration

CWE-918

CWE-306

Related Identifiers

CVE-2026-33340

Affected Products

Lollms-Webui

References · 8

• 🔥 https://github.com/ParisNeo/lollms-webui/security/advisories/GHSA-mcwr-5469-pxj4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33340 · Security Note
• https://github.com/ParisNeo/lollms-webui/blob/8c5dcef63d847bb3d027ec74915d8fe4afd3014e/lollms/server/endpoints/lollms_apps.py#L443-L450 · Note
• https://twitter.com/TheHackerWire/status/2036536515938095350 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2044143687693893849 · Twitter Post
• https://twitter.com/0dayPublishing/status/2036482991073956072 · Twitter Post
• https://twitter.com/CVEnew/status/2036505762080628868 · Twitter Post
• https://twitter.com/CveFindCom/status/2036498945266913735 · Twitter Post