CVE-2026-59213: 
Python vulnerability analysis and mitigation

CVE-2026-59213 is a cross-user model-list information disclosure vulnerability in Open WebUI, a self-hosted AI platform. Affecting versions 0.6.27 through 0.9.x, the flaw causes permission-filtered per-user model lists to share a single static cache entry, allowing one authenticated user's model list to be served to another user during the cache TTL window. The vulnerability was reported by researcher Classic298, with the fix merged on June 29, 2026, and the advisory published on July 9, 2026. It carries a CVSS v3.1 base score of 3.5 (Low) per the GitHub Security Advisory, or 5.0 (Medium) per NVD scoring (GitHub Advisory).

The root cause is a misconfiguration of the aiocache @cached decorator in backend/open_webui/routers/openai.py and backend/open_webui/routers/ollama.py (CWE-524: Use of Cache Containing Sensitive Information). In aiocache 0.12.x, the key= parameter accepts a static cache key value — when a lambda is passed to key=, the callable object itself is used as the constant key rather than being invoked per call. The intended per-user key (e.g., openai_all_models_{user.id}) was therefore never computed, causing all callers to collide onto a single shared cache entry within the MODELS_CACHE_TTL window (default: 1 second). The correct per-call hook is key_builder=, which is invoked as key_builder(func, *args, **kwargs) on each request. The fix replaces key=lambda _, user: ... with key_builder=lambda _func, request, user=None: ... at both affected call sites (GitHub Advisory, Fix PR).

Successful exploitation results in a confidentiality breach where an authenticated user can receive the permission-filtered model list belonging to a different user who populated the cache within the TTL window. This exposes information about which AI models are accessible to other users, including the existence and naming of models that may be restricted from the requesting user. There is no integrity or availability impact, and the exposure is timing-dependent and incidental — an attacker cannot select a specific victim or force a target's list into the cache on demand (GitHub Advisory).

A proof-of-concept reproduction procedure is publicly documented in the GitHub Security Advisory, demonstrating the exploit with four steps using a default Open WebUI deployment. The EPSS score is approximately 0.0026 (low probability of exploitation in the wild), and there is no evidence of active in-the-wild exploitation as of the advisory date. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a low-privilege authenticated account and relies on timing (the default TTL is 1 second), making reliable exploitation opportunistic rather than deterministic (GitHub Advisory).

1. Reconnaissance: Identify a target Open WebUI instance running versions 0.6.27–0.9.x. Confirm that multiple users with different model-access permissions exist on the deployment.
2. Obtain authentication: Acquire valid credentials for at least one low-privilege authenticated account (user B, the attacker).
3. Trigger cache population: Wait for or observe another user (user A, with different/elevated model permissions) to request the model list via the /api/models or equivalent OpenAI/Ollama router endpoint, populating the shared static cache entry.
4. Race the TTL window: Within the MODELS_CACHE_TTL period (default 1 second), send an authenticated GET request to the model list endpoint (e.g., GET /api/models) as user B.
5. Receive leaked data: User B's response contains user A's permission-filtered model list, including models that user B is not authorized to access, disclosing restricted model names and availability (GitHub Advisory).

• Logs: Repeated authenticated requests to the model list endpoint (e.g., /api/models, /ollama/api/tags) from multiple distinct user accounts within very short intervals (sub-second), which may indicate deliberate timing attempts to exploit the cache window.
• Application Behavior: Users reporting unexpected model lists — seeing models they do not have permission to access — in the Open WebUI interface or API responses.
• Network: Unusual frequency of model-list API calls from a single authenticated user account, potentially scripted to poll within the TTL window repeatedly.

Upgrade Open WebUI to version 0.10.0 or later, which replaces the misconfigured key=lambda with the correct key_builder= parameter at both affected call sites in routers/openai.py and routers/ollama.py (v0.10.0 Release, Fix Commit). If an immediate upgrade is not possible, consider implementing network-level access controls to restrict which users can reach the OpenAI and Ollama router endpoints, or reduce the MODELS_CACHE_TTL environment variable to 0 to disable caching entirely as a temporary workaround. Monitoring model-list API access patterns for anomalous cross-user timing can help detect exploitation attempts in the interim.