Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency… (CVE-2026-109297)
Description
Open WebUI versions from 0.11.0 up to but not including 0.11.4 contain a denial of service vulnerability in the automation recurrence-rule validator. This vulnerability arises because the validator's sub-daily frequency guard parses rule text more strictly than the calendar library that executes it, allowing crafted rules to expand per second and block the shared event loop for minutes. The issue affects users permitted to create automations who can submit specially crafted recurrence rules that cause synchronous blocking on every scheduler poll.
CVSS v3.1
Score 6.5medium
Affected software
pkg:github/open-webui/open-webuiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109297 describes a denial of service vulnerability in Open WebUI versions 0.11.0 before 0.11.4. The flaw exists in the automation recurrence-rule validator, where the sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. This discrepancy allows users with automation creation privileges to submit whitespace-folded rules, lowercase frequencies (in 0.11.0), or omitted RRULE prefixes that expand per second synchronously. This synchronous expansion blocks the shared event loop for minutes per request and on every scheduler poll, leading to denial of service.
Potential Impact
The vulnerability can cause denial of service by blocking the shared event loop for extended periods, impacting availability. It requires user privileges to create automations but does not affect confidentiality or integrity. There are no known exploits in the wild.
Mitigation Recommendations
A fix is available in Open WebUI version 0.11.4. Users should upgrade to version 0.11.4 or later to remediate this vulnerability. No other mitigation guidance is provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m3p8-5778-73h9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-109297"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6acd55492cdf04f656da84cf
Added to database: 10/12/2026, 21:46:49 UTC
Last enriched: 10/12/2026, 21:54:14 UTC
Last updated: 10/13/2026, 03:48:11 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.