Lucene search
+L

1 matches found

PyPA
PyPA
added 2026/08/04 11:34 a.m.25 views

Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)

SummaryThe getallmodels handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of keybuilder=. In aiocache 0.12.3 the pinned version, key= is a static cache...

5CVSS5.5AI score0.00297EPSS
SaveExploits1References8Affected Software1
Rows per page
Query Builder