CVE-2026-70493: Open WebUI Regex DoS Vulnerability

CVE-2026-70493 Overview

CVE-2026-70493 is a Regular Expression Denial of Service (ReDoS) vulnerability in Open WebUI, a self-hosted AI platform. The flaw affects versions from 0.9.6 until 0.11.0. The built-in knowledge search path in backend/open_webui/tools/knowledge_fs.py and backend/open_webui/tools/builtin.py allows a chat participant to submit a regex pattern that is compiled with Python's backtracking re engine. A crafted pattern such as (x|x)*y combined with a matching uploaded file line pins one CPU core and blocks the async event loop. This produces availability impact for every other user on the affected worker. The issue is tracked as [CWE-1333] and is fixed in 0.11.0.

Critical Impact
An authenticated low-privilege user can stall an entire Open WebUI worker by submitting a catastrophic backtracking pattern, denying service to all co-located users.

Affected Products

Open WebUI versions 0.9.6 through versions prior to 0.11.0
backend/open_webui/tools/knowledge_fs.py knowledge search tool
backend/open_webui/tools/builtin.py builtin tool re-exports

Discovery Timeline

2026-08-04 - CVE-2026-70493 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70493

Vulnerability Analysis

Open WebUI exposes a knowledge search tool that lets chat participants grep against uploaded knowledge files. The tool accepts a user-supplied pattern and executes it line-by-line across every reachable file. Patterns are compiled with Python's built-in re engine, which uses backtracking and offers no timeout. When a pattern contains ambiguous alternations or nested quantifiers, matching against a suitable input line becomes exponential in time. One request can therefore saturate a CPU core and, because the search runs on the same thread as the FastAPI event loop, block all concurrent async requests handled by that worker.

This is a classic algorithmic complexity attack against a shared multi-tenant service. The vulnerability is authenticated but requires only chat-participant privileges, and no user interaction from other tenants is needed.

Root Cause

The root cause is unbounded regex evaluation. The code compiled arbitrary user-controlled patterns using re.compile and iterated matches without a per-search timeout or complexity guard. Any pattern with catastrophic backtracking properties, such as (x|x)*y, produces exponential match time once a partial-match line is encountered in the knowledge corpus.

Attack Vector

An authenticated user issues a chat request that invokes the knowledge search tool with a crafted pattern. Because the pattern executes on the worker's event loop thread, one request is sufficient to freeze the worker for other tenants until the process is restarted or the pathological match completes.

python

# Security patch excerpt: backend/open_webui/tools/knowledge_fs.py
# Re-exported through builtin.py for consistent imports.

import contextvars
import json
import logging
import re
import shlex
import time
from contextlib import contextmanager
from typing import Optional

import regex  # replaces `re` for timeout-bounded matching
from fastapi import Request

log = logging.getLogger(__name__)

text

# Security patch excerpt: backend/requirements.txt
requests==2.34.2
regex==2026.5.9  # supports a per-search timeout, which `re` does not
aiohttp==3.13.5

Source: GitHub Commit 3ab2026

Detection Methods for CVE-2026-70493

Indicators of Compromise

Sustained 100% CPU on a single Open WebUI worker process correlated with a chat request invoking the knowledge search tool.
Chat tool invocations containing regex metacharacters and nested quantifiers such as (a|a)*, (.*)*, or (x+x+)+.
Health checks or WebSocket keepalives timing out for co-located users while one request is in flight.

Detection Strategies

Log every knowledge search invocation with the submitted pattern, user identifier, and execution duration.
Alert on any single tool invocation whose execution time exceeds an expected upper bound, for example one second.
Track per-user rates of knowledge search tool calls to identify abusive patterns from a single account.

Monitoring Recommendations

Monitor Open WebUI worker CPU utilization and event loop lag using process-level metrics.
Forward Open WebUI application logs to a centralized SIEM and correlate CPU spikes with tool invocation records.
Track version strings reported by Open WebUI instances to confirm that all deployments have moved to 0.11.0 or later.

How to Mitigate CVE-2026-70493

Immediate Actions Required

Upgrade Open WebUI to version 0.11.0 or later on all workers.
Restart any worker showing sustained single-core saturation to release stalled requests.
Restrict knowledge search tool access to trusted user roles until the upgrade is complete.

Patch Information

The fix is in Open WebUI v0.11.0. The maintainers replaced Python's re module with the third-party regex package, which supports a per-match timeout. See the security advisory GHSA-2f54-p244-32q6 and the pull request discussion for context.

Workarounds

Disable the built-in knowledge search tool for untrusted users until patched.
Deploy Open WebUI behind a reverse proxy that enforces a strict per-request timeout for chat endpoints.
Run multiple worker processes so a single stalled worker does not remove all service capacity.

bash

# Upgrade Open WebUI to the fixed release
pip install --upgrade 'open-webui>=0.11.0'

# Or for containerized deployments
docker pull ghcr.io/open-webui/open-webui:0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 ghcr.io/open-webui/open-webui:0.11.0