CVE-2026-109299

6.5Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-400

Impact

Authenticated users with automations access can crash or hang the Open WebUI instance by triggering an uncontrolled resource consumption denial of service. They only need access to automation creation or update endpoints to stall the shared event loop.

Root cause

The application fails to validate recurrence rules properly, causing the event loop to block when computing impossible dates such as February 30th.

Affected systems

Open WebUI 0.9.0 before 0.11.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade Open WebUI to version 0.11.4 or later. If upgrading immediately is not possible, restrict or revoke user permissions for automations.

shell

$ pip install --upgrade open-webui==0.11.4

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109299