CVE-2026-109299

6.5 MEDIUMpublic exploit available

Published 2026-10-12 · Updated 2026-10-13

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-400

Public exploit & PoC references

https://github.com/open-webui/open-webui/commit/5fb869db221d9599a576e8e2eea9c3314947d25e
https://github.com/open-webui/open-webui/security/advisories/GHSA-5w58-mwmh-vf2m

All references

https://github.com/open-webui/open-webui/commit/5fb869db221d9599a576e8e2eea9c3314947d25e
https://github.com/open-webui/open-webui/security/advisories/GHSA-5w58-mwmh-vf2m
https://www.vulncheck.com/advisories/open-webui-0.9.0-before-0.11.4-denial-of-service-via-recurrence-rule-validation

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100137
HIGHCVE-2026-100138
HIGHCVE-2026-100139
HIGHCVE-2026-100242PoC
MEDIUMCVE-2026-100350PoC
MEDIUMCVE-2026-100527PoC
LOWCVE-2026-100542PoC
HIGHCVE-2026-100558PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.