CVE-2026-109295: Open WebUI: ReDoS via grep file tools stalls workers

MEDIUMPoC AVAILABLECISA: TRACK*

Published October 12, 2026

CISO Take

Open WebUI 0.11.0 through 0.11.3 has a regular expression denial of service flaw: an authenticated user can get the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, which blocks the server event loop for about two seconds per call. Repeating the call can keep workers stalled and make the whole chat platform unavailable to every user. Severity is medium (CVSS 6.5, availability-only impact). There is no known public exploit, no Nuclei template, and the CVE is not in CISA KEV. EPSS data is not yet available, and only 3 downstream dependents are tracked, so the blast radius is limited to organizations running Open WebUI themselves. That said, the package has 184 other CVEs, which signals a heavy patching cadence. Upgrade to 0.11.4 or later, and until then restrict access to trusted accounts and watch for slow or hung worker processes.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium. Exploitation is network-reachable with low complexity and needs only a low-privilege authenticated account, with no user interaction. Impact is limited to availability (A:H) with no confidentiality or integrity loss. The attacker does not need to write the regex themselves, because they can instruct the model to supply it through a tool call, so it works as a prompt-driven attack. Exposure is highest for multi-user or internet-facing deployments that allow open sign-up. Single-user or private deployments carry little risk. There is no known in-the-wild exploitation and no public PoC.

How does the attack unfold?

Initial Access

The attacker signs in with a low-privilege account on a reachable Open WebUI instance.

AML.T0012

Tool Invocation

The attacker prompts the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex.

AML.T0053

Exploitation

The regex engine blocks the server event loop for about two seconds per call, and the attacker repeats the call.

AML.T0034.002

Impact

Server workers stall and the Open WebUI service becomes unavailable to all users.

AML.T0029

Initial Access

The attacker signs in with a low-privilege account on a reachable Open WebUI instance.

AML.T0012

Tool Invocation

The attacker prompts the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex.

AML.T0053

Exploitation

The regex engine blocks the server event loop for about two seconds per call, and the attacker repeats the call.

AML.T0034.002

Impact

Server workers stall and the Open WebUI service becomes unavailable to all users.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade open-webui (pip) to 0.11.4 or later. 2) Until patched, disable open sign-up and restrict accounts to trusted users, and remove or disable the file search tools if the configuration allows. 3) Run multiple workers and apply per-user rate limits at the reverse proxy to reduce the impact of repeated calls. 4) Monitor for elevated event-loop latency, worker timeouts, 5xx spikes, and tool-call logs showing grep_knowledge_files or grep_chat_files with nested-quantifier patterns such as (a+)+ . 5) Review GHSA-gfjp-5hc9-852r for vendor guidance.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFrameworkAgentRAGAML.T0029- Denial of AI Service AML.T0034.002- Agentic Resource Consumption AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and resource availability

OWASP LLM Top 10

LLM06-Excessive AgencyLLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-109295?

Is CVE-2026-109295 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-109295, increasing the risk of exploitation.

How to fix CVE-2026-109295?

1) Upgrade open-webui (pip) to 0.11.4 or later. 2) Until patched, disable open sign-up and restrict accounts to trusted users, and remove or disable the file search tools if the configuration allows. 3) Run multiple workers and apply per-user rate limits at the reverse proxy to reduce the impact of repeated calls. 4) Monitor for elevated event-loop latency, worker timeouts, 5xx spikes, and tool-call logs showing grep_knowledge_files or grep_chat_files with nested-quantifier patterns such as (a+)+ . 5) Review GHSA-gfjp-5hc9-852r for vendor guidance.

What systems are affected by CVE-2026-109295?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, RAG pipelines, agent tool-calling frameworks, self-hosted model UIs.

What is the CVSS score for CVE-2026-109295?

CVE-2026-109295 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsRAG pipelinesagent tool-calling frameworksself-hosted model UIs

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.002Agentic Resource Consumption

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06, LLM10

What are the technical details?

Original Advisory

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call.

Exploitation Scenario

An attacker registers or uses a low-privilege account on a shared Open WebUI instance. They send a chat message telling the model to run grep_knowledge_files with a catastrophically backtracking pattern such as (a+)+$ against a knowledge file with matching content. The regex blocks the event loop for about two seconds. By repeating the instruction in a loop or across several sessions, the attacker keeps the server workers busy, and legitimate users see timeouts and an unresponsive AI platform.

Weaknesses (CWE)

CWE-1333Inefficient Regular Expression Complexity

CWE-1333 — Inefficient Regular Expression Complexity: The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

[Architecture and Design] Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
[System Configuration] Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Source: MITRE CWE corpus.