What is the CVSS score of CVE-2026-59213?

CVE-2026-59213 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-59213?

Yes, a public proof-of-concept exploit is available for CVE-2026-59213. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-59213?

Yes, a patch is available for CVE-2026-59213. Update the affected software to the latest version immediately.

Open WebUI CVE-2026-59213

EUVD-2026-42629 MEDIUM

Use of Cache Containing Sensitive Information (CWE-524)

2026-07-09 security-advisories@github.com

GHSA-3wp3-xxj9-5jqq

Information Disclosure Open Webui Openwebui

5.0

CVSS 3.1 · NVD

Severity by source

Vendor (github) PRIMARY

LOW

qualitative

NVD

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

3.5 LOW

AV:N for web API access, AC:H for TTL timing dependency, PR:L for authenticated-only exploitation, S:C because cross-user data crosses trust boundaries, C:L for model list metadata only.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jul 10, 2026 - 19:52 NVD

LOW MEDIUM

CVSS changed

Jul 10, 2026 - 19:52 NVD

3.5 (LOW) 5.0 (MEDIUM)

Patch available

Jul 09, 2026 - 18:01 EUVD

Analysis Generated

Jul 09, 2026 - 17:41 vuln.today

DescriptionNVD

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry and exposing one user’s model list to another caller during the TTL window. This issue is fixed in version 0.10.0.

AnalysisAI

Cache key misconfiguration in Open WebUI versions 0.6.27 through 0.9.x leaks permission-filtered model lists across authenticated users during the aiocache TTL window. The flaw exists in both the OpenAI and Ollama router handlers, where a lambda was incorrectly passed as the cache key instead of a per-user key_builder, collapsing all users into a single shared cache entry. An authenticated attacker on a shared instance can receive a different user's model list - revealing which AI models that user has access to - with no public exploit identified at time of analysis and a vendor-released patch available in v0.10.0.

Technical ContextAI

Open WebUI is a self-hosted AI frontend that proxies requests to backends such as Ollama and OpenAI-compatible endpoints. The affected code paths are get_all_models handlers in routers/openai.py and routers/ollama.py, which use the Python aiocache library for response caching. CWE-524 (Use of Cache Containing Sensitive Information) describes the root cause precisely: instead of supplying a user-scoped key_builder callable that would generate distinct cache keys per authenticated user, the handlers passed a static lambda as the key parameter. This causes all users' permission-filtered model lists to collapse into a single shared cache entry. Any subsequent caller during the TTL window retrieves the first cached user's model list rather than their own. The scope change (S:C in the CVSS vector) reflects that the confidentiality breach crosses user trust boundaries within the same application instance.

RemediationAI

Vendor-released patch: v0.10.0. Administrators should upgrade Open WebUI to version 0.10.0 or later immediately; the fix is confirmed in the GitHub release at https://github.com/open-webui/open-webui/releases/tag/v0.10.0 and the underlying code change is visible in commit 0fc630b34b2899599dabffffa012afd47599aa75. If an immediate upgrade is not possible, a targeted workaround is to disable response caching in the aiocache configuration for the get_all_models endpoints - this eliminates the shared-entry race condition at the cost of increased backend latency on model list requests. Restricting the Open WebUI deployment to a single user or to users with identical model permissions removes the meaningful information disclosure, though it does not address the underlying bug. Network-layer controls (firewall, VPN restriction) do not mitigate this flaw since exploitation only requires authenticated access from any network-accessible session.