PT-2026-110716 · Git+1 · Open-Webui
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Open WebUI versions 0.9.0 through 0.11.3
Description
Authenticated users with automations permission can cause a denial of service by submitting unsatisfiable recurrence rules. By sending invalid dates, such as February 30th, to the 'automations create' or 'automations update' endpoints, an attacker can block the shared event loop for several seconds per request, stalling the instance.
Recommendations
Update Open WebUI to version 0.11.4 or later.
Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Open-Webui