CVE-2026-33340 - Vulnerability Analysis

Overview

LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication.

Severity & Score

Impact

Attackers can access internal services, scan local networks, or exfiltrate sensitive cloud metadata, potentially leading to data exposure and further compromise.

Mitigation

Update to a patched version once available or apply mitigations to restrict server-side requests.

References

• https://github.com/ParisNeo/lollms-webui/blob/8c5dcef63d847bb3d027ec74915d8fe4afd3014e/lollms/server/endpoints/lollms_apps.py#L443-L450
• https://github.com/ParisNeo/lollms-webui/security/advisories/GHSA-mcwr-5469-pxj4

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 24, 2026

🔴 CVE-2026-33340 - Critical (9.1) LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. The `@router.post("/... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33340/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner