CVE-2026-109297: Open WebUI: automation recurrence rules cause DoS

MEDIUMPoC AVAILABLECISA: TRACK*

Published October 12, 2026

CISO Take

Open WebUI 0.11.0 through 0.11.3 has a denial-of-service flaw in its automation scheduler: the validator that blocks sub-daily recurrence rules parses text more strictly than the calendar library that actually runs it, so a low-privileged user can submit a rule that expands per second and freezes the shared event loop for minutes per request. The scheduler re-polls the stored rule, so the instance can stay degraded until the automation is deleted. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so exploitation pressure is currently low, and the 3 downstream dependents limit the blast radius. The impact is still real for shared internal AI portals, because one authenticated user can take chat access away from everyone. Upgrade to 0.11.4 or later, and until then restrict who can create automations.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium (CVSS 6.5). It is network-reachable with low complexity and needs only a low-privilege account, with no user interaction. Impact is limited to availability, with no confidentiality or integrity loss. There is no known exploitation, public PoC or scanner template, but the technique is simple once the advisory is read. The persistent trigger on every scheduler poll raises operational risk above what the score suggests. Exposure is highest in multi-tenant or self-service deployments where many users can create automations.

How does the attack unfold?

Initial Access

An attacker uses a low-privilege Open WebUI account that is allowed to create automations.

AML.T0012

Exploitation

The attacker submits a whitespace-folded or lowercase recurrence rule that bypasses the validator's sub-daily frequency guard.

AML.T0049

Persistence

The stored rule is re-evaluated on every scheduler poll, so the blocking recurs after each poll or restart.

Impact

The shared event loop is blocked for minutes at a time, so chat, RAG and API access become unavailable to all users.

AML.T0029

Initial Access

An attacker uses a low-privilege Open WebUI account that is allowed to create automations.

AML.T0012

Exploitation

The attacker submits a whitespace-folded or lowercase recurrence rule that bypasses the validator's sub-daily frequency guard.

AML.T0049

Persistence

The stored rule is re-evaluated on every scheduler poll, so the blocking recurs after each poll or restart.

Impact

The shared event loop is blocked for minutes at a time, so chat, RAG and API access become unavailable to all users.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

6 steps

Upgrade open-webui to 0.11.4 or later.
Until patched, limit automation-creation permissions to trusted admins through role and group settings.
Audit stored automations for unusual recurrence rules, such as whitespace-folded text, lowercase frequencies, missing RRULE prefixes or any rule that could expand to SECONDLY frequency, and delete them.
Monitor for high CPU use, event-loop lag and health-check timeouts on the Open WebUI process.
Run behind a supervisor or health-check restart and apply per-user rate limits at the reverse proxy.
If the instance is stuck after a restart, remove the offending automation records directly in the database.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFrameworkAPIAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown risks and system failures

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-109297?

Is CVE-2026-109297 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-109297, increasing the risk of exploitation.

How to fix CVE-2026-109297?

1. Upgrade open-webui to 0.11.4 or later. 2. Until patched, limit automation-creation permissions to trusted admins through role and group settings. 3. Audit stored automations for unusual recurrence rules, such as whitespace-folded text, lowercase frequencies, missing RRULE prefixes or any rule that could expand to SECONDLY frequency, and delete them. 4. Monitor for high CPU use, event-loop lag and health-check timeouts on the Open WebUI process. 5. Run behind a supervisor or health-check restart and apply per-user rate limits at the reverse proxy. 6. If the instance is stuck after a restart, remove the offending automation records directly in the database.

What systems are affected by CVE-2026-109297?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Self-hosted AI portals, RAG pipelines, Multi-user model gateways.

What is the CVSS score for CVE-2026-109297?

CVE-2026-109297 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsSelf-hosted AI portalsRAG pipelinesMulti-user model gateways

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.

Exploitation Scenario

An authenticated employee with the default ability to create automations submits a recurrence rule that the validator accepts as a safe frequency but the calendar library reads as SECONDLY, for example by folding whitespace or using lowercase text. The server expands the rule synchronously and blocks the event loop for minutes. The scheduler then re-evaluates the rule on every poll, so chat, RAG and API access for the whole organization stay degraded until an administrator finds and deletes the automation.

Weaknesses (CWE)

CWE-400Uncontrolled Resource Consumption CWE-436Interpretation Conflict

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.