CVE-2026-70489 Details
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.
A denial-of-service vulnerability has been identified in Open WebUI versions 0.9.0 prior to 0.11.0. The issue arises from the automation recurrence parsing, which incorrectly anchors minutely and hourly rules to a fixed date in the year 2000. This flaw forces the application to synchronously process a large number of occurrences, blocking the event loop that handles scheduling, HTTP, and WebSocket traffic. As a result, the instance becomes unresponsive for all users except the one who created the automation. The vulnerability can be exploited by any user with permission to create automations, which is typically an admin on default deployments but can be granted to regular users on customized ones.
Users can upgrade to Open WebUI version 0.11.0, which fixes the vulnerability by anchoring sub-daily rules to the current time instead of a fixed past date. The update also allows 'DTSTART' to be respected when it indicates a reasonable number of occurrences, ensuring that automations do not cause unnecessary delays.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-webui/open-webui/security/advisories/GHSA-73cq-mcgh-379c | CISA-ADP | ExploitVendor Advisory |
| https://github.com/open-webui/open-webui/commit/c4ae8c86786fed521960466f6d8eef8af22c2946 | [email protected] | Patch |
| https://github.com/open-webui/open-webui/releases/tag/v0.11.0 | [email protected] | Release Notes |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-73cq-mcgh-379c | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwebui open webui | >= 0.9.0, < 0.11.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |