CVE-2026-88002: Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/openwebui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open WebUIto a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Open WebUI user can exploit it. No user interaction is required, and the attack can be performed remotely over the network.
What conditions are required for exploitation?
The attacker must be able to store chat messages without an id field and arrange their parent references into a cycle. Triggering reconstruction of that chat history then causes a non-terminating traversal.
What is the operational impact?
The non-terminating walk blocks the async event loop and consumes memory until the process terminates, causing a denial of service. The malicious cyclic history persists across process restarts, so restarting alone does not remove the condition.
Which versions are affected and how can it be fixed?
Versions from 0.5.0 through 0.11.1 are described as affected. The issue is fixed in version 0.11.1.