MEDIUM 6.5 GitHub
CVE-2026-70489
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
## Summary
In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single `FREQ=MINUTELY` rule therefore enumerates roughly a quarter-century of occurrences, synchronously, on the event loop that also serves the scheduler, HTTP and WebSocket traffic. Nothing bounds the walk, and nothing moves it off the loop.
## Preconditions
Any user who can create an automatio
Affected Products
- pip/open-webui >= 0.9.0, < 0.11.0
References
- https://github.com/advisories/GHSA-73cq-mcgh-379c
- https://github.com/open-webui/open-webui/security/advisories/GHSA-73cq-mcgh-379c
- https://github.com/open-webui/open-webui/commit/c4ae8c86786fed521960466f6d8eef8af22c2946
- https://github.com/open-webui/open-webui/releases/tag/v0.11.0
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-08-04 via GitHub. Affected: pip/open-webui >= 0.9.0, < 0.11.0.
vulnfeed aggregates 9214 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.