CVE-2026-109299: Open WebUI recurrence rule DoS

CISO Take

Open WebUI versions 0.9.0 through 0.11.3 fail to validate recurrence rules in the automations feature, so an authenticated user can submit an unsatisfiable rule such as February 30th and block the shared event loop for seconds per request. Repeated requests can make the whole instance unresponsive for every user, which matters for organizations that run Open WebUI as a shared internal LLM front end. Risk is moderate: it is a medium-severity (CVSS 6.5) availability-only flaw that needs a low-privileged account with automations permission, has no known public exploit, no Nuclei template, no KEV listing, and no EPSS data, and only 3 tracked downstream dependents limit the supply chain blast radius. Upgrade to 0.11.4 or later, and until then restrict the automations permission to trusted users and rate-limit the automations create and update endpoints. Note that the package has 184 other CVEs on record, so patch hygiene and network exposure deserve a broader review.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium. Exploitation is trivial for any authenticated user with automations permission (network vector, low complexity, no user interaction), but impact is limited to availability, with no confidentiality or integrity effect. There is no evidence of active exploitation, no public exploit, and no EPSS or SSVC data. Exposure is highest for multi-tenant or internet-facing Open WebUI deployments where many users hold the automations permission, since one account can degrade service for everyone. The package's 184 other CVEs suggest a large attack surface and a high patching cadence.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege account that holds the automations permission.

AML.T0012

Exploitation

Attacker submits an unsatisfiable recurrence rule, such as February 30th, to the automations create or update endpoint.

AML.T0049

Resource Exhaustion

The server blocks the shared event loop for seconds while evaluating the impossible rule, and repeated requests sustain the stall.

Impact

All users of the instance experience hung or failed chat and API requests, causing denial of AI service.

AML.T0029

Initial Access

Attacker authenticates with a low-privilege account that holds the automations permission.

AML.T0012

Exploitation

Attacker submits an unsatisfiable recurrence rule, such as February 30th, to the automations create or update endpoint.

AML.T0049

Resource Exhaustion

The server blocks the shared event loop for seconds while evaluating the impossible rule, and repeated requests sustain the stall.

Impact

All users of the instance experience hung or failed chat and API requests, causing denial of AI service.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 32% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade open-webui to 0.11.4 or later (fix commit 5fb869db221d9599a576e8e2eea9c3314947d25e). 2) Until patched, revoke or restrict the automations permission to trusted users via role and group settings. 3) Apply rate limiting or WAF rules on the automations create and update endpoints at the reverse proxy. 4) Monitor for event loop latency spikes, slow responses, and repeated automation create or update calls from a single account, and audit existing automations for impossible schedules such as day 30 of February. 5) Review account provisioning and remove unused accounts, and keep the instance off the public internet or behind SSO and VPN where possible.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFrameworkAPIAML.T0012- Valid Accounts AML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and disruptions

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-109299?

Open WebUI versions 0.9.0 through 0.11.3 fail to validate recurrence rules in the automations feature, so an authenticated user can submit an unsatisfiable rule such as February 30th and block the shared event loop for seconds per request. Repeated requests can make the whole instance unresponsive for every user, which matters for organizations that run Open WebUI as a shared internal LLM front end. Risk is moderate: it is a medium-severity (CVSS 6.5) availability-only flaw that needs a low-privileged account with automations permission, has no known public exploit, no Nuclei template, no KEV listing, and no EPSS data, and only 3 tracked downstream dependents limit the supply chain blast radius. Upgrade to 0.11.4 or later, and until then restrict the automations permission to trusted users and rate-limit the automations create and update endpoints. Note that the package has 184 other CVEs on record, so patch hygiene and network exposure deserve a broader review.

Is CVE-2026-109299 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-109299, increasing the risk of exploitation.

How to fix CVE-2026-109299?

1) Upgrade open-webui to 0.11.4 or later (fix commit 5fb869db221d9599a576e8e2eea9c3314947d25e). 2) Until patched, revoke or restrict the automations permission to trusted users via role and group settings. 3) Apply rate limiting or WAF rules on the automations create and update endpoints at the reverse proxy. 4) Monitor for event loop latency spikes, slow responses, and repeated automation create or update calls from a single account, and audit existing automations for impossible schedules such as day 30 of February. 5) Review account provisioning and remove unused accounts, and keep the instance off the public internet or behind SSO and VPN where possible.

What systems are affected by CVE-2026-109299?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Self-hosted model serving gateways, Multi-user internal AI platforms.

What is the CVSS score for CVE-2026-109299?

CVE-2026-109299 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsSelf-hosted model serving gatewaysMulti-user internal AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.

Exploitation Scenario

An attacker with a low-privilege account on a company's internal Open WebUI instance, whether a legitimate employee, a contractor, or a user created through open signup, opens the automations feature and creates an automation with a recurrence rule for February 30th. The server spends seconds searching for a date that never occurs, blocking the event loop so every other user's chat requests hang. The attacker scripts repeated create or update calls to keep the service degraded, disrupting the organization's internal AI assistant until an administrator patches or disables the account.

Weaknesses (CWE)

CWE-400Uncontrolled Resource Consumption CWE-834Excessive Iteration

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.