CVE-2026-70493 in Open WebUI
Summary
by MITRE • 08/05/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file with no time limit, so a crafted pattern such as (x|x)*y and one matching uploaded file line can pin one CPU core and block the event loop. This causes availability impact for every other user of the affected worker. This issue is fixed in 0.11.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability exists within Open WebUI's knowledge search functionality between versions 0.9.6 and 0.11.0, specifically in the file paths backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py. This flaw represents a classic regular expression denial of service (ReDoS) vulnerability that exploits Python's backtracking regex engine. The system allows chat participants to specify search patterns that are then compiled using Python's re module and executed against every line of every accessible file in the knowledge base without any time or resource limitations. When maliciously crafted regex patterns containing catastrophic backtracking sequences are submitted, such as (x|x)*y, the processing becomes exponentially slow, effectively consuming CPU resources and blocking the event loop for extended periods.
The technical implementation of this vulnerability stems from the lack of input sanitization and resource limiting in the regex processing pipeline. The system processes user-provided patterns through Python's default regex engine which employs backtracking to find matches, making it susceptible to catastrophic backtracking scenarios where a small input can cause exponential execution time. When such patterns are applied against even moderately sized files containing matching lines, the regex engine enters into an infinite loop of backtracking states, causing one cpu core to be consumed at 100% utilization for extended periods. This behavior directly violates security principle of least privilege and resource isolation, as a single malicious pattern can compromise the entire worker process.
The operational impact of this vulnerability extends beyond simple performance degradation to full service availability disruption. Since the event loop is blocked during regex processing, all other users sharing the same worker process experience complete unresponsiveness or severe delays in service delivery. This creates a denial of service condition where legitimate users cannot access knowledge search functionality while the malicious pattern is being processed. The vulnerability affects every user of the affected worker, making it particularly dangerous in multi-tenant environments where multiple users share computational resources. The issue demonstrates poor defensive programming practices and highlights the importance of implementing proper input validation and resource constraints when processing untrusted data.
Mitigation strategies should include implementing regex engine timeout limits, sanitizing user inputs before pattern compilation, and using more secure regex engines that prevent catastrophic backtracking. The fix implemented in version 0.11.0 likely addresses this by introducing time limits on regex operations or switching to a more robust regex engine implementation. Security practitioners should also consider implementing rate limiting for search operations and validating regex patterns against known dangerous sequences before execution. This vulnerability aligns with CWE-400 which covers unspecified errors in resource management, and maps to ATT&CK technique T1496 for resource exhaustion attacks. Organizations using affected versions should immediately upgrade to 0.11.0 or later while implementing additional input validation measures to prevent similar issues in other components of their systems.