CVE-2026-109299
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows…
- Risk score
- 45/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking t…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.11.4 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.
Last activity 12 Oct 2026. Patch Forecast updates every hour.