---
id: CVE-2026-109299
title: >-
  Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability
  that allows authenticated users with automations permission to stall the
  instance by submitting unsatisfiable recurrence rules
summary: >-
  Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability
  that allows authenticated users with automations permission to stall the
  instance by submitting unsatisfiable recurrence rules. Attackers can
  repeatedly send …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-834
published: '2026-10-12'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:39:48.767'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109299'
references:
  - url: >-
      https://github.com/open-webui/open-webui/commit/5fb869db221d9599a576e8e2eea9c3314947d25e
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/open-webui/open-webui/security/advisories/GHSA-5w58-mwmh-vf2m
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/open-webui-0.9.0-before-0.11.4-denial-of-service-via-recurrence-rule-validation
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00376
epssPercentile: 0.31378
ingestedAt: '2026-10-12T18:00:08.193Z'
vendor: open-webui
product: open-webui
affected:
  - open-webui >= 0.9.0 < 0.11.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T15:49:05.696356Z'
---

## Overview

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.