Resource Exhaustion Vulnerability in Open WebUI Self-Hosted AI Platform
CVE-2026-70493

6.5MEDIUM

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
4 August 2026

What is CVE-2026-70493?

The Open WebUI self-hosted AI platform is susceptible to a resource exhaustion vulnerability due to improper handling of regex patterns in its backend. This flaw occurs between versions 0.9.6 and 0.11.0, allowing a chat participant to exploit the knowledge search feature with crafted regex patterns. When such patterns are processed, they can consume excessive CPU resources, leading to a denial of service for other users by blocking the event loop. The issue is resolved in version 0.11.0.

Affected Version(s)

open-webui >= 0.9.6, < 0.11.0

References

https://github.com/open-webui/open-webui/security/advisor...
x_refsource_CONFIRM
https://github.com/open-webui/open-webui/pull/27471
x_refsource_MISC
https://github.com/open-webui/open-webui/commit/3ab202626...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.