CVE-2026-88002 - Open WebUI Vulnerability Exposes Server to Hang

CVE-2026-88002 - Open WebUI Vulnerability

🚨 CVE-2026-88002: Open WebUI allows any authenticated user to hang the server via a cyclic chat message history. Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. This vulnerability affects versions from 0.5.0 until 0.11.1.

Details

The core issue involves the message-chain reconstruction helper in backend/open_webui/utils/misc.py. This helper advanced through a chat history by map key but tracked visited entries using each message body’s optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts.

Exploitability

• Remotely Exploit: Yes!
• CVSS Score: 6.5 (MEDIUM)

Resolution

To resolve this denial-of-service vulnerability, users should update Open WebUI to version 0.11.1 and restart the application process. This issue is fixed in version 0.11.1.

For more information, you can read the complete article here: Read full article

Stay safe and keep your systems updated! 🚀