CVE-2026-109299
Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation
- State
- Published
- Severity
- 7.1 High
- Published
- Oct 12, 2026
- Updated
- Oct 23, 2026
- Reserved
- Oct 12, 2026
Description
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
open-webuiopen-webui |
|
References
- GitHub Security Advisory (GHSA-5w58-mwmh-vf2m)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.