CVE-2026-87013: Open WebUI authenticated DoS

Q: Is CVE-2026-87013 actively exploited?

No confirmed active exploitation of CVE-2026-87013 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-87013?

Upgrade to Open WebUI 0.11.1 or later, which fixes both the missing cycle check on POST /api/v1/folders/{id}/update/parent and the missing visited-node tracking in the DELETE and read tree-walk logic. If immediate patching isn't possible, restrict folder-management API access to trusted roles only as a stopgap, and run a one-off database query against the folders table to detect any parent_id chain that loops back on itself or on a descendant, remediating any found before they're triggered. Post-patch, monitor for anomalous sustained CPU/memory usage on the Open WebUI process correlated with folder delete/read API calls, which would indicate an existing unremediated cycle or a regression.

Q: What systems are affected by CVE-2026-87013?

This vulnerability affects the following AI/ML architecture patterns: self-hosted LLM chat platforms, multi-tenant AI deployments, model serving.

Q: What is the CVSS score for CVE-2026-87013?

CVE-2026-87013 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.28%.

CISO Take

A logic flaw in Open WebUI's folder API (CWE-835) lets any authenticated user, even one with low privileges, set a folder's parent to itself or one of its own descendants, creating a cycle that the DELETE and read-folder endpoints fail to detect when walking the tree. Once planted, a single request sends the server into an unbounded loop that consumes CPU and memory indefinitely, and the malicious cycle persists in the database until an admin manually repairs it, so the outage can recur every time that folder is touched again. There is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template, so this looks like a quiet bug fix rather than an active campaign, but the 4.3 CVSS score understates the operational risk for a self-hosted AI chat platform where one low-privilege or compromised internal account can degrade service for the entire instance. Open WebUI carries 168 other CVEs and 3 tracked downstream dependents, a reminder that this is a fast-moving codebase that needs disciplined patch cadence. Upgrade to Open WebUI 0.11.1 immediately; if you cannot patch right away, audit the folders table for self-referential or cyclic parent_id chains and alert on CPU/memory spikes correlated with folder delete or read API calls.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Network-exploitable with low attack complexity and no user interaction, but requires low-privileged authentication (PR:L), which caps the CVSS at 4.3 (medium). Impact is availability-only (A:L, no confidentiality or integrity loss), and the flaw is not remotely exploitable pre-auth. No EPSS score, no CISA KEV entry, no known public exploit or scanner template exist, indicating no evidence of active or opportunistic exploitation. Real-world risk is elevated in multi-tenant or shared self-hosted deployments where any registered user (including a low-trust or compromised account) can trigger a persistent, self-renewing denial of service that survives until manually remediated at the database level.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privileged authenticated account on a shared Open WebUI instance.

AML.T0012

Plant Cycle

Attacker calls POST /api/v1/folders/{id}/update/parent to set a folder's parent to itself or one of its descendants, persisting a parent cycle in the database.

AML.T0034.001

Trigger

Attacker (or any user) issues a DELETE or read request against the cyclic folder, causing the server's tree-walk logic to loop without termination.

AML.T0034

Impact

Server CPU and memory are consumed indefinitely, degrading or crashing the Open WebUI instance for all users until the stored cycle is manually repaired.

AML.T0029

Initial Access

Attacker obtains or already holds a low-privileged authenticated account on a shared Open WebUI instance.

AML.T0012

Plant Cycle

Attacker calls POST /api/v1/folders/{id}/update/parent to set a folder's parent to itself or one of its descendants, persisting a parent cycle in the database.

AML.T0034.001

Trigger

Attacker (or any user) issues a DELETE or read request against the cyclic folder, causing the server's tree-walk logic to loop without termination.

AML.T0034

Impact

Server CPU and memory are consumed indefinitely, degrading or crashing the Open WebUI instance for all users until the stored cycle is manually repaired.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.10.0, <= 0.11.0	`0.11.1`
151.8K 3 dependents Pushed 7d ago 83% patched ~5d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I None

A Low

What should I do?

1 step

Upgrade to Open WebUI 0.11.1 or later, which fixes both the missing cycle check on POST /api/v1/folders/{id}/update/parent and the missing visited-node tracking in the DELETE and read tree-walk logic. If immediate patching isn't possible, restrict folder-management API access to trusted roles only as a stopgap, and run a one-off database query against the folders table to detect any parent_id chain that loops back on itself or on a descendant, remediating any found before they're triggered. Post-patch, monitor for anomalous sustained CPU/memory usage on the Open WebUI process correlated with folder delete/read API calls, which would indicate an existing unremediated cycle or a regression.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Framework API AML.T0034 - Cost Harvesting AML.T0034.001 - Resource-Intensive Queries AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system operational resilience

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-87013?

A logic flaw in Open WebUI's folder API (CWE-835) lets any authenticated user, even one with low privileges, set a folder's parent to itself or one of its own descendants, creating a cycle that the DELETE and read-folder endpoints fail to detect when walking the tree. Once planted, a single request sends the server into an unbounded loop that consumes CPU and memory indefinitely, and the malicious cycle persists in the database until an admin manually repairs it, so the outage can recur every time that folder is touched again. There is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template, so this looks like a quiet bug fix rather than an active campaign, but the 4.3 CVSS score understates the operational risk for a self-hosted AI chat platform where one low-privilege or compromised internal account can degrade service for the entire instance. Open WebUI carries 168 other CVEs and 3 tracked downstream dependents, a reminder that this is a fast-moving codebase that needs disciplined patch cadence. Upgrade to Open WebUI 0.11.1 immediately; if you cannot patch right away, audit the folders table for self-referential or cyclic parent_id chains and alert on CPU/memory spikes correlated with folder delete or read API calls.

Is CVE-2026-87013 actively exploited?

No confirmed active exploitation of CVE-2026-87013 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-87013?

Upgrade to Open WebUI 0.11.1 or later, which fixes both the missing cycle check on POST /api/v1/folders/{id}/update/parent and the missing visited-node tracking in the DELETE and read tree-walk logic. If immediate patching isn't possible, restrict folder-management API access to trusted roles only as a stopgap, and run a one-off database query against the folders table to detect any parent_id chain that loops back on itself or on a descendant, remediating any found before they're triggered. Post-patch, monitor for anomalous sustained CPU/memory usage on the Open WebUI process correlated with folder delete/read API calls, which would indicate an existing unremediated cycle or a regression.

What systems are affected by CVE-2026-87013?

This vulnerability affects the following AI/ML architecture patterns: self-hosted LLM chat platforms, multi-tenant AI deployments, model serving.

What is the CVSS score for CVE-2026-87013?

CVE-2026-87013 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

self-hosted LLM chat platformsmulti-tenant AI deploymentsmodel serving

MITRE ATLAS Techniques

AML.T0034 Cost Harvesting

AML.T0034.001 Resource-Intensive Queries

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read did not track visited folder identifiers. An authenticated user could persist a parent cycle and start a request that consumed CPU and memory indefinitely, with the condition remaining stored until repaired. This issue is fixed in version 0.11.1.

Exploitation Scenario

A low-privileged authenticated user creates two folders, A and B, then calls POST /api/v1/folders/A/update/parent to set A's parent to B, followed by setting B's parent to A (or more simply, setting a folder's parent to itself), successfully persisting the cycle because the endpoint doesn't reject it. The attacker (or any other user, intentionally or not) then issues a DELETE /api/v1/folders/A request or a POST /api/v1/folders/A/read request; the server's tree-walk logic follows the parent chain without tracking visited IDs and loops indefinitely, consuming CPU and memory until the process is killed, restarted, or manually repaired at the database level. Because the cycle is stored, the same DoS condition re-triggers on any subsequent access to the affected folder tree, giving the attacker a low-effort, repeatable denial-of-service lever against the shared instance.

Weaknesses (CWE)

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') Primary CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

CWE-835 — Loop with Unreachable Exit Condition ('Infinite Loop'): The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Source: MITRE CWE corpus.