TI-2026-71115 Aliases CVE-2026-109299 GHSA-vp3m-gw6c-whgh

Denial of service in Open WebUI via recurrence rule validation

LOW 31CWE-400Published 2026-10-12 · Updated 2026-10-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service flaw in its recurrence rule validation (CWE-834, Excessive Iteration). An authenticated user with automations permission can submit unsatisfiable recurrence rules, such as February 30th, to the automations create or update endpoints. Each request blocks the shared event loop for seconds, and repeated requests stall the instance.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00376 31st percentileScored 2026-11-07

Fix Fixed open-webui (open-webui): 0.11.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
open-webui	open-webui	0.9.0 to before 0.11.4	0.11.4	Patch available	CNA

open-webui Vendoropen-webui Affected 0.9.0 to before 0.11.4 Fixed in 0.11.4 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:openwebui:open_webui::::::::	—	—	open-webui

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* Versions — — ·open-webui

Remediation

Upgrade Open WebUI to version 0.11.4 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA open-webui (open-webui) Fixed in 0.11.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-12
open-webui 0.11.4
19 records Highest priority Priority HIGH 3 HIGH, 8 MEDIUM, 8 LOW
Other records, highest priority first
- TI-2026-71106 Stored cross-site scripting in Open WebUI via DOCX previewPriority HIGH 72
- TI-2026-71108 Session cookie disclosure in Open WebUI OAuth-mode connectionsPriority HIGH 68
- TI-2026-71104 Stored cross-site scripting in Open WebUI markdown linksPriority HIGH 67
Show all 19 records →

Timeline

2026-10-12 Threatist record created from CVE-2026-109299
2026-10-12 Alias added: GHSA-vp3m-gw6c-whgh
2026-10-13 Priority changed: MEDIUM → LOW
2026-10-13 CISA SSVC decision points changed
2026-10-24 Weakness changed · CNA

References

Patch 1

Patch Commit

Advisory 1

GitHub Security Advisory (GHSA-5w58-mwmh-vf2m)

TI-2024-06216 Open WebUI Arbitrary File Upload + Path Traversal CVSS 3.1HIGH 8.8
TI-2024-07467 Improper Authentication in open-webui/open-webui CVSS 3.1HIGH 8.2
TI-2026-42359 Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id CVSS 3.1CRITICAL 9.0
TI-2026-40759 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation CVSS 4.0CRITICAL 9.0
TI-2024-07431 Cross-site Scripting (XSS) in open-webui/open-webui CVSS 3.0CRITICAL 9.0
TI-2026-60021 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin CVSS 3.1HIGH 8.7

See all 175 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences