---
id: CVE-2026-109299
title: >-
  Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability
  that allows authenticated users with automations permission to stall the
  instance by submitting unsatisfiable recurrence rules
summary: >-
  Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability
  that allows authenticated users with automations permission to stall the
  instance by submitting unsatisfiable recurrence rules. Attackers can
  repeatedly send …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:23.540'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109299'
references:
  - url: >-
      https://github.com/open-webui/open-webui/commit/5fb869db221d9599a576e8e2eea9c3314947d25e
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/open-webui/open-webui/security/advisories/GHSA-5w58-mwmh-vf2m
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/open-webui-0.9.0-before-0.11.4-denial-of-service-via-recurrence-rule-validation
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.193Z'
---

## Overview

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.