CVE-2026-59213

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.27 through 0.9.x

Description The get all models handlers in routers/openai.py and routers/ollama.py incorrectly pass a lambda to the aiocache key instead of the key builder. This causes permission-filtered per-user model lists to share a static cache entry, which can expose one user's model list to another caller during the Time To Live (TTL) window. TTL is the period during which a cached item is considered valid before it expires.

Recommendations Update to version 0.10.0.