CVE-2026-70489

6.5 MEDIUMpublic exploit available

Published 2026-08-04 · Updated 2026-08-05

AI risk analysis

Summary: The flaw allows automation rules to cause availability issues for other users due to synchronous computation on the event loop.
Exploitability: Exploitation requires access to the affected version of Open WebUI and a trigger condition, making it moderately difficult.
Blast radius: If exploited, this could significantly impact the availability of the platform for all users sharing the instance.
Prioritized remediation: Upgrade to Open WebUI 0.11.0 or later to mitigate the issue.

availabilitysynchronous-computationevent-loopupgrade

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-400, CWE-1333

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.