Summary
Open WebUI: Cross-user model-list exposure via static cache key in getallmodels (aiocache key= vs key_builder= misuse)
The get_all_models handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of key_builder=. In aiocache 0.12.3 (the pinned version), key= is a static cache key, a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided onto a single shared cache entry within the TTL window. During that window, one user's permission-filtered model list could be served to a different authenticated user, crossing the per-user authorization boundary.
Affected component
backend/open_webui/routers/openai.py,get_all_models(~line 488)backend/open_webui/routers/ollama.py,get_all_models(~line 302)
Both decorated with @cached(ttl=MODELS_CACHE_TTL, key=lambda ...). No other @cached(... key=lambda ...) misuse was found elsewhere in the backend.
Root cause
aiocache 0.12's @cached treats key= as a static key; the per-call hook is key_builder= with signature key_builder(func, *args, **kwargs). Passing a callable to key= uses the callable object itself as a constant key, so every invocation resolved to the same entry and the intended per-user.id namespacing never occurred.
Reproduction (default config)
- On a default deployment, configure at least two users with different model-access permissions (e.g. one model restricted to user A).
- As user A, request the model list (populates the shared cache entry).
- Within
MODELS_CACHE_TTL(default 1s), as user B, request the model list. - User B receives user A's permission-filtered list, including models B is not permitted to see.
Impact
- Boundary crossed: Confidentiality (cross-user). A caller can receive the model list scoped to a different security principal than themselves.
- A user (or admin, or, depending on endpoint reachability, anonymous caller) who populates the cache causes the next caller within the TTL to receive that list rather than their own permission-filtered one.
- What's disclosed is the set of models another principal can access, including potentially the existence and naming of models restricted from the receiving user.
- Exposure is incidental and timing-dependent, not attacker-controlled: the leaked entry is whatever the most recent caller populated within
MODELS_CACHE_TTL(default 1 second), and the attacker cannot select the victim or force a target's list into the cache.
CVE-2026-59213 has a CVSS score of 3.5 (Low). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.10.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Replace key= with key_builder= at both call sites and adjust the lambda to take the function as its first argument:
@cached(
ttl=MODELS_CACHE_TTL,
key_builder=lambda _func, request, user=None: (
f'openai_all_models_{user.id}' if user else 'openai_all_models'
),
)
Frequently Asked Questions
- What is CVE-2026-59213? CVE-2026-59213 is a low-severity security vulnerability in open-webui (pip), affecting versions >= 0.6.27, < 0.10.0. It is fixed in 0.10.0.
- How severe is CVE-2026-59213? CVE-2026-59213 has a CVSS score of 3.5 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of open-webui are affected by CVE-2026-59213? open-webui (pip) versions >= 0.6.27, < 0.10.0 is affected.
- Is there a fix for CVE-2026-59213? Yes. CVE-2026-59213 is fixed in 0.10.0. Upgrade to this version or later.
- Is CVE-2026-59213 exploitable, and should I be worried? Whether CVE-2026-59213 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-59213 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-59213? Upgrade
open-webuito 0.10.0 or later.