https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:44:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335461 EUVD-2026-335461 https://cve.radiocsirt.org/vuln/euvd-2026-335461 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59213 <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry and exposing one user’s model list to another caller during the TTL window. This issue is fixed in version 0.10.0.</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry and exposing one user’s model list to another caller during the TTL window. This issue is fixed in version 0.10.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59213 https://cve.radiocsirt.org/vuln/ghsa-3wp3-xxj9-5jqq <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>The `get_all_models` handlers in `routers/openai.py` and `routers/ollama.py` intended to cache their **permission-filtered** model lists per user, but the `@cached` decorator was misconfigured: it passed a `key=` lambda instead of `key_builder=`. In aiocache 0.12.3 (the pinned version), `key=` is a **static** cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided onto a single shared cache entry within the TTL window. During that window, one user&#39;s permission-filtered model list could be served to a different authenticated user, crossing the per-user authorization boundary.</p> <p>## Impact</p> <p>- **Boundary crossed:** Confidentiality (cross-user). A caller can receive the model list scoped to a *different* security principal than themselves. - A user (or admin, or — depending on endpoint reachability — anonymous caller) who populates the cache causes the next caller within the TTL to receive *that* list rather than their own permission-filtered one. - What&#39;s disclosed is the set of models another principal can access, including potentially the existence and naming of models restricted from the receiving user. - Exposure is **incidental and timing-dependent**, not attacker-controlled: the leaked entry is whatever the most recent caller populated within `MODELS_CACHE_TTL` (default 1 second), and the attacker cannot select the victim or force a target&#39;s list into the ca…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>The `get_all_models` handlers in `routers/openai.py` and `routers/ollama.py` intended to cache their **permission-filtered** model lists per user, but the `@cached` decorator was misconfigured: it passed a `key=` lambda instead of `key_builder=`. In aiocache 0.12.3 (the pinned version), `key=` is a **static** cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided onto a single shared cache entry within the TTL window. During that window, one user&#39;s permission-filtered model list could be served to a different authenticated user, crossing the per-user authorization boundary.</p> <p>## Impact</p> <p>- **Boundary crossed:** Confidentiality (cross-user). A caller can receive the model list scoped to a *different* security principal than themselves. - A user (or admin, or — depending on endpoint reachability — anonymous caller) who populates the cache causes the next caller within the TTL to receive *that* list rather than their own permission-filtered one. - What&#39;s disclosed is the set of models another principal can access, including potentially the existence and naming of models restricted from the receiving user. - Exposure is **incidental and timing-dependent**, not attacker-controlled: the leaked entry is whatever the most recent caller populated within `MODELS_CACHE_TTL` (default 1 second), and the attacker cannot select the victim or force a target&#39;s list into the ca…</p> https://cve.radiocsirt.org/vuln/ghsa-3wp3-xxj9-5jqq https://cve.radiocsirt.org/vuln/pysec-2026-3589 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>The `get_all_models` handlers in `routers/openai.py` and `routers/ollama.py` intended to cache their **permission-filtered** model lists per user, but the `@cached` decorator was misconfigured: it passed a `key=` lambda instead of `key_builder=`. In aiocache 0.12.3 (the pinned version), `key=` is a **static** cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided onto a single shared cache entry within the TTL window. During that window, one user&#39;s permission-filtered model list could be served to a different authenticated user, crossing the per-user authorization boundary.</p> <p>## Impact</p> <p>- **Boundary crossed:** Confidentiality (cross-user). A caller can receive the model list scoped to a *different* security principal than themselves. - A user (or admin, or — depending on endpoint reachability — anonymous caller) who populates the cache causes the next caller within the TTL to receive *that* list rather than their own permission-filtered one. - What&#39;s disclosed is the set of models another principal can access, including potentially the existence and naming of models restricted from the receiving user. - Exposure is **incidental and timing-dependent**, not attacker-controlled: the leaked entry is whatever the most recent caller populated within `MODELS_CACHE_TTL` (default 1 second), and the attacker cannot select the victim or force a target&#39;s list into the ca…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>The `get_all_models` handlers in `routers/openai.py` and `routers/ollama.py` intended to cache their **permission-filtered** model lists per user, but the `@cached` decorator was misconfigured: it passed a `key=` lambda instead of `key_builder=`. In aiocache 0.12.3 (the pinned version), `key=` is a **static** cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided onto a single shared cache entry within the TTL window. During that window, one user&#39;s permission-filtered model list could be served to a different authenticated user, crossing the per-user authorization boundary.</p> <p>## Impact</p> <p>- **Boundary crossed:** Confidentiality (cross-user). A caller can receive the model list scoped to a *different* security principal than themselves. - A user (or admin, or — depending on endpoint reachability — anonymous caller) who populates the cache causes the next caller within the TTL to receive *that* list rather than their own permission-filtered one. - What&#39;s disclosed is the set of models another principal can access, including potentially the existence and naming of models restricted from the receiving user. - Exposure is **incidental and timing-dependent**, not attacker-controlled: the leaked entry is whatever the most recent caller populated within `MODELS_CACHE_TTL` (default 1 second), and the attacker cannot select the victim or force a target&#39;s list into the ca…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3589