CVE-2026-70489 in Open WebUI
Summary
by MITRE • 08/05/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability exists within Open WebUI's automation scheduling system where recurrence parsing logic suffers from severe performance degradation and resource exhaustion issues. The flaw specifically affects versions between 0.9.0 and 0.11.0, creating a critical availability risk for all users of the platform. The core technical issue manifests in the backend/open_webui/utils/automations.py file where automation recurrence parsing implements a fundamentally flawed algorithm for handling minutely and hourly scheduling rules.
The problematic implementation anchors all FREQ=MINUTELY rules to a fixed date of 2000-01-01 and then iterates forward one interval at a time to determine subsequent execution times. This approach creates an enormous computational overhead where a single FREQ=MINUTELY rule generates approximately 25 years worth of scheduling occurrences that must be computed synchronously on the main event loop. The synchronous nature of this processing blocks the entire event loop, which simultaneously handles scheduler operations, HTTP requests, and WebSocket communications.
This design flaw directly impacts system availability by causing significant delays and potential timeouts for all users accessing the instance. When the automation scheduler processes a single minutely rule, it must perform approximately 13 million iterations to compute future occurrences, consuming excessive CPU cycles and memory resources. The scheduler recomputes the next execution time for every claimed database row during each polling cycle, amplifying the performance impact exponentially.
The vulnerability demonstrates characteristics consistent with CWE-704 (Incorrect Type Conversion or Cast) and CWE-691 (Insufficient Control Flow Management) as it fails to properly handle recursive computation of scheduling rules. From an operational security perspective, this issue creates a denial of service condition that affects all concurrent users and can lead to complete system unresponsiveness. The attack surface is particularly concerning because the vulnerability affects core scheduling functionality that many users rely upon for automated tasks.
The fix implemented in version 0.11.0 addresses this by replacing the synchronous iteration approach with a more efficient algorithm that calculates future occurrences without generating massive iteration sequences. This change aligns with ATT&CK technique T1499.004 (Resource Hijacking) by preventing malicious actors from exploiting the system's scheduling capabilities to consume excessive resources and cause availability issues for legitimate users.
The root cause stems from inadequate input validation and resource management within the automation parsing component, where temporal recurrence patterns are processed without considering their computational complexity. This type of vulnerability often occurs in systems where developers assume that all temporal patterns will have reasonable computational requirements, failing to account for edge cases involving long-term recurrence rules that can generate enormous datasets.
Organizations using affected versions should immediately upgrade to version 0.11.0 or later to prevent potential service disruption and resource exhaustion. The mitigation strategy involves not only updating the software but also implementing monitoring for unusual CPU utilization patterns that might indicate this vulnerability being exploited, particularly in environments where automation scheduling is heavily utilized.