CVE-2026-59213: 
Open WebUI vulnerability analysis and mitigation

CVE-2026-59213 is a cross-user model-list information disclosure vulnerability in Open WebUI, a self-hosted AI platform. Affecting versions 0.6.27 through 0.9.x, the flaw causes permission-filtered per-user model lists to share a single static cache entry, allowing one authenticated user's model list to be served to another user during the cache TTL window. The vulnerability was published on July 9, 2026, and is fixed in version 0.10.0. It carries a CVSS v3.1 base score of 5.0 (Medium) per NVD, or 3.5 (Low) per the GitHub Security Advisory (GitHub Advisory).

The root cause is a misconfiguration of the aiocache @cached decorator in backend/open_webui/routers/openai.py (around line 488) and backend/open_webui/routers/ollama.py (around line 302), classified as CWE-524 (Use of Cache Containing Sensitive Information). In aiocache 0.12.3, the key= parameter accepts a static cache key value — when a lambda is passed to key=, the callable object itself is used as a constant key rather than being invoked per call. The intended per-user namespacing (e.g., openai_all_models_{user.id}) was therefore never computed, causing all callers to collide onto a single shared cache entry within the MODELS_CACHE_TTL window (default: 1 second). The correct per-call hook is key_builder=, which is invoked as key_builder(func, *args, **kwargs) on each request (GitHub Advisory, Fix PR).

Any authenticated user who queries the get_all_models endpoint within the TTL window after another user has populated the cache will receive that other user's permission-filtered model list, crossing the per-user authorization boundary. This exposes the existence and naming of AI models that may be restricted from the receiving user, constituting a confidentiality breach. There is no integrity or availability impact, and the exposure is timing-dependent and incidental — an attacker cannot select a specific victim or force a target's list into the cache (GitHub Advisory).

1. Setup: Obtain two authenticated accounts on a vulnerable Open WebUI instance (versions 0.6.27–0.9.x) with different model-access permissions — for example, User A has access to a restricted model that User B does not.
2. Populate the cache: As User A, send an authenticated GET request to the model list endpoint (e.g., /api/models or the OpenAI/Ollama router's get_all_models endpoint). This populates the shared static cache entry with User A's permission-filtered model list.
3. Race the TTL window: Within the MODELS_CACHE_TTL period (default: 1 second), as User B, send an authenticated GET request to the same model list endpoint.
4. Receive leaked data: User B receives User A's cached model list — including models restricted from User B — instead of their own permission-filtered list, confirming cross-user information disclosure (GitHub Advisory).

• Logs: Repeated authenticated requests to the get_all_models endpoint (OpenAI or Ollama routers) from multiple distinct user accounts within very short intervals (sub-second), particularly from accounts with lower privilege levels querying immediately after higher-privilege accounts.
• Application Behavior: Users reporting visibility of AI models they should not have access to, or model lists that do not match their assigned permissions.
• Network: Unusual frequency of model-list API calls from a single low-privilege account, potentially indicating deliberate timing attempts to catch another user's cached response.

The fix is included in Open WebUI version 0.10.0, released June 29, 2026, which replaces key=lambda with key_builder=lambda in both routers/openai.py and routers/ollama.py. Upgrading to v0.10.0 or later is the recommended remediation (v0.10.0 Release, Fix Commit). If an immediate upgrade is not possible, consider implementing network-level access controls to restrict who can reach the OpenAI and Ollama router endpoints, or add rate limiting and monitoring on model-list queries to detect suspicious access patterns (GitHub Advisory).

The vulnerability was discovered and reported by researcher Classic298, who also submitted the fix via pull request #25783. The Open WebUI maintainer (tjbck) merged the fix on June 29, 2026, and the issue was formally disclosed via GitHub Security Advisory on July 9, 2026. The NixOS security tracker also referenced the issue in a packaging advisory for open-webui versions below 0.10.0 (Fix PR, GitHub Advisory).