CVE-2026-70489: Open WebUI: automation rule parsing freezes server

## Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single `FREQ=MINUTELY` rule therefore enumerates roughly a quarter-century of occurrences, synchronously, on the event loop that also serves the scheduler, HTTP and WebSocket traffic. Nothing bounds the walk, and nothing moves it off the loop. ## Preconditions Any user who can create an automation. `USER_PERMISSIONS_FEATURES_AUTOMATIONS` defaults to `false`, so on a default deployment only an admin can reach the create path; it becomes reachable by ordinary users on any deployment that has granted the automations feature, which is the normal way to make the feature usable. `UVICORN_WORKERS` defaults to 1, so there is no second worker to absorb the stall. The rule needs no unusual syntax: `FREQ=MINUTELY` with no `DTSTART`, or with a `DTSTART` set well in the past, is enough. ## Impact Availability, against every other user of the instance. One evaluation of `RRULE:FREQ=MINUTELY` takes 18.9 s of blocking CPU; adding a ten-value `BYSECOND` list multiplies the walk and takes 64.2 s. `FREQ=HOURLY` costs 0.34 s and is not materially exploitable on its own. The cost does not stop at creation: once the automation is stored, the scheduler recomputes the next run for every claimed row on each poll, so the same walk repeats on a default 10 s interval and the instance stays wedged rather than recovering. Instances that have not enabled the automations feature for non-admin users are exposed only to an admin doing this. ## Fix Fixed in 0.11.0. Sub-daily rules are now anchored to the current clock instead of the year-2000 date, so the walk starts at the next occurrence rather than a quarter-century behind it. A caller-supplied `DTSTART` is honoured only when the number of occurrences it implies stays under a fixed bound, and is otherwise replaced by the clock-aligned anchor. The same rules that cost 18.9 s and 64.2 s now cost under a millisecond. Upgrading fully resolves the issue, no configuration change is required. ## Root cause Affected component: `backend/open_webui/utils/automations.py`, `_parse_rule`, reached from the automation create, update and toggle handlers in `backend/open_webui/routers/automations.py` and from the scheduler's claim path in `backend/open_webui/models/automations.py`. Affected setup: every build from 0.9.0 onward, since that is when the automations feature shipped. The fixed anchor existed to make sub-daily intervals snap to clock boundaries, so that "every 5 minutes" lands on :00, :05, :10 rather than drifting from whenever the automation happened to be created. Snapping only needs a reference point of the right phase, but the implementation used a literal far-past date as that reference and left the recurrence library to walk forward from it. The distance between the anchor and the present is therefore attacker-influenced work that grows with real time, and it was never treated as a cost that needed a bound or a thread. ## Proof of concept Measured cost of a single next-run computation against the shipped 0.10.2 parser: | rule | cost | | --- | --- | | `RRULE:FREQ=MINUTELY` | 18,880 ms | | `RRULE:FREQ=MINUTELY;BYSECOND=0,1,2,3,4,5,6,7,8,9` | 64,236 ms | | `DTSTART:20000101T000000` + `RRULE:FREQ=MINUTELY` | 26,237 ms | | `RRULE:FREQ=HOURLY` | 339 ms | Measured at function level deliberately. Persisting such an automation has the scheduler repeat the walk on every poll and wedge the instance indefinitely, which is the actual impact but makes a live end-to-end run destructive to the test instance. ## Credits Reported by @Classic298.

An attacker who holds (or compromises) a standard user account on an Open WebUI instance where the automations feature has been enabled for non-admins — the normal configuration for teams that actually use the feature — opens the automation creation UI or hits the create endpoint directly and submits a recurrence rule of RRULE:FREQ=MINUTELY, optionally adding a BYSECOND list to push the cost to 64+ seconds. The single Uvicorn worker that also serves every other user's chat requests, the inference API and WebSocket connections blocks for tens of seconds computing the next occurrence. Because the automation persists, the scheduler recomputes the same expensive walk on every subsequent poll (default every 10 seconds), so the instance never recovers — effectively a one-shot, no-interaction, authenticated DoS that denies AI chat service to every other user of the shared instance until an admin manually deletes the automation or the process is restarted on a patched build.