| Component | Open WebUI |
| Severity | medium (CVSS 6.5) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Published (NVD) | 2026-10-12 |
| Last modified | 2026-10-13 |
| Affected versions | not published yet, see the advisory |
| Fixed in | see the vendor advisory |
| Weakness | CWE-400 |
| CISA KEV | not listed |
NVD description
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep Open WebUI off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-109298
- https://github.com/open-webui/open-webui/commit/97e013a66169c4fcd7f26ab9e41a4ff260ffd4da
- https://github.com/open-webui/open-webui/security/advisories/GHSA-gww9-mhgj-pfqh
- https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-memory-exhaustion-via-knowledge-search-regex
Read more
Other Open WebUI CVEs
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link UR...
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to stea...
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only fro...
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in...
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base...
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied dir...