CVE-2026-70489

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.10.0

Description Automation recurrence parsing in backend/open webui/utils/automations.py anchors minutely and hourly rules to a fixed date of 2000-01-01. When calculating the next run, the system walks forward one interval at a time from this date. A rule using FREQ=MINUTELY can cause the system to enumerate approximately 25 years of occurrences synchronously on the event loop. Because this loop also handles scheduler, HTTP, and WebSocket traffic, it leads to a denial of service affecting all users of the instance. The issue is triggered via the parse rule function, which is accessed through automation create, update, and toggle handlers in backend/open webui/routers/automations.py and the scheduler's claim path in backend/open webui/models/automations.py. The impact is exacerbated when the BYSECOND variable is used, significantly increasing the CPU blocking time.

Recommendations Update Open WebUI to version 0.11.0.