CVE-2026-70489

Received Received - Intake

Denial of Service in Open WebUI Automation

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-04

Generated

2026-08-05

AI Q&A

2026-08-05

EPSS Evaluated

N/A

NVD

CVE-2026-70489

Affected Vendors & Products

Vendor	Product	Version / Range
open_webui	open_webui	From 0.9.0 (inc) to 0.11.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This vulnerability in Open WebUI versions 0.9.0 to 0.11.0 involves improper handling of automation recurrence rules. The system incorrectly anchors minutely and hourly rules to a fixed date (2000-01-01) and then processes each occurrence one by one. This causes excessive synchronous computation on the event loop handling scheduler, HTTP, and WebSocket traffic, leading to availability issues for all users on the instance.

Detection Guidance

Check Open WebUI version. If between 0.9.0 and 0.10.x, the system may be vulnerable. Monitor for high CPU usage or unresponsiveness in the scheduler process.

Impact Analysis

The vulnerability can cause your Open WebUI instance to become slow or unresponsive. This happens because the system spends too much time processing automation rules instead of handling other tasks like user requests or real-time communication. Users may experience delays or failures when interacting with the platform.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.0 or later immediately. Restart the service to apply changes and monitor system performance.

Hi! I’m here to help you understand CVE-2026-70489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70