{"id":"CVE-2026-70489","published":"2026-08-04T21:16:37.763","lastModified":"2026-08-05T15:17:11.507","description":"Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400","CWE-1333"],"vendors":[],"products":[],"references":[{"url":"https://github.com/open-webui/open-webui/commit/c4ae8c86786fed521960466f6d8eef8af22c2946","tags":[]},{"url":"https://github.com/open-webui/open-webui/releases/tag/v0.11.0","tags":[]},{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-73cq-mcgh-379c","tags":[]},{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-73cq-mcgh-379c","tags":[]}],"exploitRefs":[{"url":"https://github.com/open-webui/open-webui/commit/c4ae8c86786fed521960466f6d8eef8af22c2946","tags":[]},{"url":"https://github.com/open-webui/open-webui/releases/tag/v0.11.0","tags":[]},{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-73cq-mcgh-379c","tags":[]},{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-73cq-mcgh-379c","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows automation rules to cause availability issues for other users due to synchronous computation on the event loop.","exploitability":"Exploitation requires access to the affected version of Open WebUI and a trigger condition, making it moderately difficult.","blast_radius":"If exploited, this could significantly impact the availability of the platform for all users sharing the instance.","remediation":"Upgrade to Open WebUI 0.11.0 or later to mitigate the issue.","tags":["availability","synchronous-computation","event-loop","upgrade"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T07:06:11.853Z"}}