The get_all_models handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of key_builder=. In aiocache 0.12.3 (the pinned version), key= is a static cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided onto a single shared cache entry within the TTL window. During that window, one user's permission-filtered model list could be served to a different authenticated user, crossing the per-user authorization boundary.
Impact
Boundary crossed: Confidentiality (cross-user). A caller can receive the model list scoped to a different security principal than themselves.
A user (or admin, or — depending on endpoint reachability — anonymous caller) who populates the cache causes the next caller within the TTL to receive that list rather than their own permission-filtered one.
What's disclosed is the set of models another principal can access, including potentially the existence and naming of models restricted from the receiving user.
Exposure is incidental and timing-dependent, not attacker-controlled: the leaked entry is whatever the most recent caller populated within MODELS_CACHE_TTL (default 1 second), and the attacker cannot select the victim or force a target's list into the cache.
Both decorated with @cached(ttl=MODELS_CACHE_TTL, key=lambda ...). No other @cached(... key=lambda ...) misuse was found elsewhere in the backend.
Root cause
aiocache 0.12's @cached treats as a static key; the per-call hook is with signature . Passing a callable to uses the callable object itself as a constant key, so every invocation resolved to the same entry and the intended per- namespacing never occurred.
key=
key_builder=
key_builder(func, *args, **kwargs)
key=
user.id
Reproduction (default config)
On a default deployment, configure at least two users with different model-access permissions (e.g. one model restricted to user A).
As user A, request the model list (populates the shared cache entry).
Within MODELS_CACHE_TTL (default 1s), as user B, request the model list.
User B receives user A's permission-filtered list, including models B is not permitted to see.
Remediation
Replace key= with key_builder= at both call sites and adjust the lambda to take the function as its first argument:
@cached(
ttl=MODELS_CACHE_TTL,
key_builder=lambda _func, request, user=None: (
f'openai_all_models_{user.id}' if user else 'openai_all_models'
),
)