Low severity3.5NVD Advisory· Published Jul 9, 2026· Updated Jul 10, 2026
CVE-2026-59213
CVE-2026-59213
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry and exposing one user’s model list to another caller during the TTL window. This issue is fixed in version 0.10.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
open-webuiPyPI | >= 0.6.27, < 0.10.0 | 0.10.0 |
Affected products
20.6.27 <= 0.10.0+ 1 more
- (no CPE)range: 0.6.27 <= 0.10.0
- cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*range: >=0.6.27,<0.10.0
Patches
Vulnerability mechanics
References
6- github.com/open-webui/open-webui/commit/0fc630b34b2899599dabffffa012afd47599aa75nvdPatchWEB
- github.com/open-webui/open-webui/pull/25783nvdIssue TrackingPatchWEB
- github.com/open-webui/open-webui/security/advisories/GHSA-3wp3-xxj9-5jqqnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-3wp3-xxj9-5jqqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59213ghsaADVISORY
- github.com/open-webui/open-webui/releases/tag/v0.10.0nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.