CVE-2026-88002 in Open WebUI
Summary
by MITRE • 09/09/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
Open WebUI serves as an extensible, feature-rich, and user-friendly self-hosted artificial intelligence platform designed to facilitate interaction with large language models through a web interface. Within the software versions ranging from 0.5.0 up to and including 0.11.1, a critical logic flaw exists in the backend utility module responsible for reconstructing message chains during chat sessions. This component is tasked with traversing historical conversation data to present coherent context to the model or user interface. The vulnerability stems from an inconsistency between how messages are indexed within the internal map structure and how they are tracked as visited nodes during traversal operations. Specifically, while the system advances through the chat history using a unique message identifier key stored in the map, it simultaneously relies on an optional id field present within each individual message body to determine whether that specific entry has already been processed.
The technical flaw arises because this optional id field is not guaranteed to be populated for every message. When an authenticated user constructs and submits messages without including a unique identifier in their metadata or payload, the traversal algorithm encounters entries where the visited-tracking mechanism fails to register them as previously seen. If these id-less messages are arranged such that they form a parent-child cycle within the chat history structure, the reconstruction helper enters an infinite loop. Because this operation is executed asynchronously on the main event loop of the application server, the non-terminating walk effectively blocks all other asynchronous tasks from executing. This results in a complete denial of service for the web interface and any API endpoints dependent on that process instance.
The operational impact of this vulnerability is severe due to its persistence and resource consumption characteristics. As the infinite loop continues, it consumes increasing amounts of memory as the system attempts to manage stack frames or internal state related to the traversal without ever completing. Eventually, this leads to out-of-memory conditions causing the application process to terminate abruptly. However, because the flawed chat history data remains stored in the underlying database or file storage, restarting the Open WebUI service does not resolve the issue. The next time a user accesses that specific conversation thread, the same infinite loop is triggered immediately upon reconstruction of the message chain, creating a persistent denial-of-service condition until the maliciously crafted data is manually removed from the backend storage.
This vulnerability aligns with CWE-835, which describes loops that do not terminate correctly due to flawed logic in tracking visited states or boundary conditions. It also relates to CWE-400 regarding uncontrolled resource consumption, as the infinite loop leads directly to excessive memory allocation and CPU usage. From a threat modeling perspective consistent with MITRE ATT&CK techniques, this represents an impact category of Denial of Service (Impact: DoS), specifically leveraging application layer protocols or services rather than network-level flooding. The requirement for authentication limits the attack surface but does not eliminate it, as any valid user account can exploit this flaw against other users if they have access to shared conversation threads or through self-inflicted damage that disrupts service availability for all tenants on a multi-user instance.
Mitigation strategies primarily involve upgrading to version 0.11.1 or later, where the developers have corrected the traversal logic to ensure consistent identification of visited nodes regardless of whether optional id fields are present. In environments where immediate patching is not feasible, administrators should implement strict input validation on client applications to ensure that all message submissions include unique identifiers in their metadata payloads. Additionally, deploying a Web Application Firewall with rules capable of detecting abnormal memory usage patterns or prolonged execution times for chat history retrieval endpoints can provide a layer of defense against exploitation attempts. Regular auditing of stored conversation data to identify and remove any malformed entries lacking proper identification fields is also recommended as a preventive measure until the software update is applied.