CVE-2026-59213: Open WebUI — LOW

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
144.2K Pushed 7d ago 67% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

3.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Changed

C Low

I None

A None

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-59213?

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry and exposing one user’s model list to another caller during the TTL window. This issue is fixed in version 0.10.0.

Is CVE-2026-59213 actively exploited?

No confirmed active exploitation of CVE-2026-59213 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59213?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-59213?

CVE-2026-59213 has a CVSS v3.1 base score of 3.5 (LOW).

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry and exposing one user’s model list to another caller during the TTL window. This issue is fixed in version 0.10.0.

Weaknesses (CWE)

CWE-524 Use of Cache Containing Sensitive Information

CWE-524 — Use of Cache Containing Sensitive Information: The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

[Architecture and Design] Protect information stored in cache.
[Architecture and Design] Do not store unnecessarily sensitive information in the cache.

Source: MITRE CWE corpus.