Summary
The get_all_models handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of key_builder=. In aiocache 0.12.3 (the pinned version), key= is a static cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided onto a single shared cache entry within the TTL window. During that window, one user's permission-filtered model list could be served to a different authenticated user, crossing the per-user authorization boundary.
Impact
- Boundary crossed: Confidentiality (cross-user). A caller can receive the model list scoped to a different security principal than themselves.
- A user (or admin, or — depending on endpoint reachability — anonymous caller) who populates the cache causes the next caller within the TTL to receive that list rather than their own permission-filtered one.
- What's disclosed is the set of models another principal can access, including potentially the existence and naming of models restricted from the receiving user.
- Exposure is incidental and timing-dependent, not attacker-controlled: the leaked entry is whatever the most recent caller populated within
MODELS_CACHE_TTL (default 1 second), and the attacker cannot select the victim or force a target's list into the cache.
Affected component
backend/open_webui/routers/openai.py — get_all_models (~line 488)backend/open_webui/routers/ollama.py — get_all_models (~line 302)
Both decorated with @cached(ttl=MODELS_CACHE_TTL, key=lambda ...). No other @cached(... key=lambda ...) misuse was found elsewhere in the backend.
Root cause
aiocache 0.12's @cached treats key= as a static key; the per-call hook is key_builder= with signature key_builder(func, *args, **kwargs). Passing a callable to key= uses the callable object itself as a constant key, so every invocation resolved to the same entry and the intended per-user.id namespacing never occurred.
Reproduction (default config)
- On a default deployment, configure at least two users with different model-access permissions (e.g. one model restricted to user A).
- As user A, request the model list (populates the shared cache entry).
- Within
MODELS_CACHE_TTL (default 1s), as user B, request the model list.
- User B receives user A's permission-filtered list, including models B is not permitted to see.
Remediation
Replace key= with key_builder= at both call sites and adjust the lambda to take the function as its first argument:
@cached(
ttl=MODELS_CACHE_TTL,
key_builder=lambda _func, request, user=None: (
f'openai_all_models_{user.id}' if user else 'openai_all_models'
),
)References
Classic298 Reporter
Summary
The
get_all_modelshandlers inrouters/openai.pyandrouters/ollama.pyintended to cache their permission-filtered model lists per user, but the@cacheddecorator was misconfigured: it passed akey=lambda instead ofkey_builder=. In aiocache 0.12.3 (the pinned version),key=is a static cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided onto a single shared cache entry within the TTL window. During that window, one user's permission-filtered model list could be served to a different authenticated user, crossing the per-user authorization boundary.Impact
MODELS_CACHE_TTL(default 1 second), and the attacker cannot select the victim or force a target's list into the cache.Affected component
backend/open_webui/routers/openai.py—get_all_models(~line 488)backend/open_webui/routers/ollama.py—get_all_models(~line 302)Both decorated with
@cached(ttl=MODELS_CACHE_TTL, key=lambda ...). No other@cached(... key=lambda ...)misuse was found elsewhere in the backend.Root cause
aiocache 0.12's
@cachedtreatskey=as a static key; the per-call hook iskey_builder=with signaturekey_builder(func, *args, **kwargs). Passing a callable tokey=uses the callable object itself as a constant key, so every invocation resolved to the same entry and the intended per-user.idnamespacing never occurred.Reproduction (default config)
MODELS_CACHE_TTL(default 1s), as user B, request the model list.Remediation
Replace
key=withkey_builder=at both call sites and adjust the lambda to take the function as its first argument:References