CVE-2026-109299GHSA-5w58-mwmh-vf2m
open-webui: Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation
open-webui open-webui
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.11.4open-webuiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.
Text from CVE List
Affected versions 2
- open-webuiaffected: 0.9.0 before 0.11.4CVE List
- open-webuiunaffected: 0.11.4CVE List
References 3
- github.com/open-webui/open-webui/commit/5fb869db221d9599a576e8e2eea9c3314947d25eFixvia CVE List
- github.com/open-webui/open-webui/security/advisories/GHSA-5w58-mwmh-vf2mAdvisoryvia CVE List
- vulncheck.com/advisories/open-webui-0.9.0-before-0.11.4-denial-of-service-via-recurrence-rule-validationAdvisoryvia CVE List