Any authenticated user can reach disabled model provider backends via an explicit backend index

Impact

A non-administrator can direct the server to contact a provider backend outside the set it is entitled to use. This covers backends the administrator has switched off, which the equivalent routes that take no index correctly skip, and backends that serve only models the account has no access to. On two of the affected routes the outbound request carries that connection's configured API key, so the backend accepts it as an authorised call. The key itself is never returned to the caller.

The version string of any configured backend, including a disabled one, is returned to the caller verbatim. The routes that return a model catalogue disclose nothing under default configuration, because the upstream response is filtered by per-model access control before it is returned. An out-of-range index previously produced a different response from a valid one, which revealed how many connections are configured.

With BYPASS_MODEL_ACCESS_CONTROL enabled, the same missing check applied to the inference routes, so a non-administrator could send generation and embedding requests to a disabled backend and consume its capacity, rather than only listing it.

Nothing is written or deleted on any backend, no credential is disclosed to the caller, and no other account's data is exposed. The reachable destinations are limited to the connections the administrator configured, so no request can be steered to an address of the caller's choosing.

Fix

Fixed in #29619, completing an earlier change that shipped in 0.11.1. Selecting a provider connection by explicit index now requires an administrator on the affected listing routes, whether the index is given as a path segment or as a query parameter, matching the model management routes alongside them. The per-model backend check on the inference routes is no longer skipped when per-model access control is bypassed. The 0.11.1 change gated only the path form, so 0.11.1 to 0.11.3 remained reachable through the query parameter. Upgrading to 0.11.4 fully resolves the issue with no configuration change.

Root cause

The affected surface is the Ollama tag listing, version and OpenAI-format model listing routes, and the OpenAI-compatible model listing route. Each is available to any verified account and accepts the backend index both as a trailing path segment and as a query parameter on the form that takes no index. Every released version before 0.11.4 carries the code.

An earlier fix introduced a check that a caller-supplied index must point at a backend actually serving the requested model, and applied it to the routes that run inference. The listing routes were not covered, because they name no model and therefore had nothing for that check to compare against. The question they needed answering was different, namely whether the caller may address a specific connection at all, and no control existed for it. The same earlier check also stepped aside entirely when per-model access control was bypassed. That left the inference routes open in that configuration for the one case per-model access control does not describe: an administrator having disabled the backend.

Proof of concept

Two provider connections were configured through the administrator API, with index 1 marked disabled and holding a distinct API key. The backends were local HTTP servers standing in for real providers, recording every request they received along with its Authorization header. A second account was created with the user role.

As that account, requesting the tag listing, version and model listing routes with index 1, in both the path and query forms, returned HTTP 200. The disabled backend recorded each request, and the tag listing and OpenAI-compatible model listing arrived carrying the administrator's configured key for that connection. The version route returned the disabled backend's version string to the caller verbatim. An index beyond the end of the list produced a server error where a valid index produced a success, giving the number of configured connections.

With BYPASS_MODEL_ACCESS_CONTROL set to true, the same account sent a chat completion to index 1 and the disabled backend served it.

After the fix, every indexed listing request returns HTTP 401 and the indexed chat completion returns HTTP 403, and the disabled backend records nothing. Administrator access and the routes that take no index are unchanged.

Credits

Reported by @ahkarl13.