Resource exhaustion in Open WebUI - #VU140749
Published: August 3, 2026
Vulnerability identifier: #VU140749
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in _parse_rule in backend/open_webui/utils/automations.py when parsing automation recurrence rules. A remote user can create or store a specially crafted automation rule to cause a denial of service.
The issue affects instance availability because the next-run computation is performed synchronously on the event loop and is repeatedly recomputed by the scheduler after the automation is stored. On default deployments, only an admin can reach the vulnerable create path unless the automations feature has been granted to ordinary users.
Affected software
Open WebUI
Remediation
Install security update from vendor's website.
Open WebUI - update to 0.11.0