CVE-2026-109299 in Open WebUI
Summary
by MITRE • 10/12/2026
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The identified security flaw resides within Open WebUI versions ranging from 0.9.0 up to but not including version 0.11.4 and constitutes a significant denial of service vulnerability that targets authenticated users possessing automation permissions. This specific weakness arises due to insufficient input validation regarding date-based recurrence rules submitted through the automations create or update endpoints. When an attacker submits a chronologically impossible date, such as February 30th, which does not exist in any standard calendar system, the application fails to reject the invalid data immediately. Instead, it proceeds with processing logic that attempts to parse and schedule this non-existent recurrence pattern. This failure to validate temporal constraints allows malicious actors to exploit the backend scheduling mechanisms for resource exhaustion purposes.
The operational impact of this vulnerability is characterized by a severe degradation of service availability due to CPU starvation on the shared event loop. Because Open WebUI relies on an asynchronous event-driven architecture, typically implemented using Python's asyncio or similar frameworks, all incoming requests share a single thread of execution unless explicitly offloaded to separate workers. When an unsatisfiable recurrence rule is processed, the application enters a prolonged computational state attempting to resolve the invalid date logic. This process blocks the shared event loop for several seconds per request. Since the event loop handles multiple concurrent connections, this blocking behavior creates a bottleneck that prevents other legitimate users from processing their requests effectively. An attacker can exploit this by repeatedly sending these malformed recurrence rules in rapid succession, leading to a cascading effect where the entire instance becomes unresponsive or experiences extreme latency for all connected clients.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-400 Resource Exhaustion under Denial of Service conditions. The attack vector is classified as Network-based but requires authentication, placing it within the scope of authenticated attacks in the MITRE ATT&CK framework, specifically relating to resource exhaustion techniques that aim to disrupt service availability rather than compromise data integrity or confidentiality. The exploitation does not require complex payload construction beyond submitting a simple invalid date string, making it highly accessible for automated abuse tools once valid credentials are obtained through phishing or credential stuffing campaigns targeting users with automation privileges.
Mitigation strategies should focus on immediate patching and defensive configuration changes. Organizations running Open WebUI must upgrade to version 0.11.4 or later where this validation logic has been corrected to reject invalid dates before they enter the scheduling pipeline. For environments that cannot immediately update, implementing a web application firewall rule to detect and block requests containing obvious date anomalies in automation endpoints can provide temporary relief. Additionally, administrators should review user permissions to ensure that only trusted individuals have access to create or modify automations, thereby reducing the attack surface for authenticated denial of service attacks. Enforcing rate limiting on these specific API endpoints can also help mitigate the impact by preventing rapid-fire submission of malicious recurrence rules, allowing the system to recover between requests and maintain availability for legitimate operations.