Denial of Service Vulnerability in Open WebUI Automation Features

CVE-2026-109297

What is CVE-2026-109297?

A denial of service vulnerability has been identified in the Open WebUI versions prior to 0.11.4. This issue is rooted in the automation recurrence-rule validator which employs more stringent parsing rules than the underlying calendar library. As a result, users with permission to create automations can exploit this vulnerability by submitting malformed rules, such as whitespace-folded rules or improperly formatted frequencies. These submissions can lead to significant performance degradation, causing the shared event loop to be blocked for extended periods during each request, which affects the overall responsiveness of the system and disrupts normal operations.

References