CVE-2026-88000 in Open WebUI
Summary
by MITRE • 09/09/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/{id}/messages/{message_id} used the chat-history deletion helper in backend/open_webui/models/chats.py to follow childrenIds without recording visited message identifiers. An authenticated user could store a cyclic chat tree and delete a message, causing a synchronous infinite loop on the server request loop that blocked every user's requests until the process was killed. This issue is fixed in version 0.11.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within Open WebUI versions ranging from 0.10.0 to 0.11.1 represents a critical availability risk stemming from improper input validation and state management during the deletion of chat messages. The application, designed as an extensible self-hosted AI platform, processes user requests through its backend API endpoints. Specifically, the DELETE /api/v1/chats/{id}/messages/{message_id} endpoint relies on a helper function located in the backend/open_webui/models/chats.py module to manage the removal of messages and their associated metadata. This helper is responsible for traversing the chat history structure, which can include nested or linked message identifiers known as childrenIds, to ensure that all related data points are removed from the system when a parent message is deleted.
The core technical flaw lies in the traversal algorithm used by this deletion helper. When processing a request to delete a specific message, the function iterates through the childrenIds associated with that message to locate and remove subsequent messages in the chain. However, the implementation fails to maintain a record of visited message identifiers during this recursive or iterative process. In standard tree-traversal algorithms for data structures like chat histories, it is essential to track previously encountered nodes to prevent re-processing them. Without such tracking mechanisms, if the underlying data structure contains a cycle—where one child node eventually points back to an ancestor or another node already in the processing queue—the traversal logic will enter an infinite loop.
This flaw allows for a specific type of denial-of-service attack known as a ReDoS-like resource exhaustion via cyclic structures, although it is technically a logical infinite loop rather than regular expression complexity. An authenticated user can exploit this by constructing and storing a chat tree that contains a cycle in its message references. By subsequently issuing a DELETE request against any message within or leading to this cyclic structure, the server-side processing thread becomes trapped in an endless iteration. Because the deletion process is synchronous and blocks the request loop on the server, it effectively halts all other incoming requests for every user of the platform until the offending process is manually terminated by system administrators. This results in a complete service outage rather than just degradation, impacting availability significantly.
From a classification perspective, this vulnerability aligns with CWE-835, which describes loops that do not terminate properly due to missing termination conditions or state tracking. It also relates to CWE-770, concerning the allocation of resources without limits, as the unbounded execution consumes CPU and memory indefinitely. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior can be categorized under T1499 Endpoint Denial of Service, specifically leveraging resource exhaustion through application logic flaws rather than network flooding or brute force techniques. The attack vector requires authentication, placing it within the scope of authenticated attacks where a malicious insider or compromised account holder can disrupt service for others.
Mitigation strategies primarily involve upgrading to version 0.11.1 or later, where this issue has been resolved by implementing proper visited-node tracking in the chat deletion helper function. For environments that cannot immediately upgrade, defensive coding practices should be adopted within custom integrations or forks of the software. Developers must ensure that any recursive traversal over graph-like structures includes a mechanism to track visited nodes, such as using a hash set or similar data structure to record identifiers already processed. Additionally, implementing depth limits on recursion can provide an additional layer of defense against stack overflow or infinite loop scenarios. Input validation should also be strengthened to detect and reject cyclic references in chat history data before they are persisted or processed by deletion routines. Regular code audits focusing on graph traversal algorithms are recommended to prevent similar logical errors in other parts of the application that handle hierarchical or linked data structures.