CVE-2026-87013: Open WebUI Folder Cycle DoS Vulnerability

CVE-2026-87013 Overview

Open WebUI is a self-hosted AI platform that provides an extensible interface for interacting with large language models. CVE-2026-87013 is a denial-of-service vulnerability affecting versions from 0.10.0 up to but not including 0.11.1. The flaw allows an authenticated user to create a cycle in the folder hierarchy by placing a folder under itself or one of its descendants. Subsequent recursive folder operations then consume CPU and memory without termination. The issue is categorized under CWE-835: Loop with Unreachable Exit Condition and is fixed in version 0.11.1.

Critical Impact
An authenticated attacker can persist a folder parent cycle that causes the server to enter an infinite recursion on DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read, exhausting resources until the stored state is repaired.

Affected Products

Open WebUI version 0.10.0 through 0.11.0
Self-hosted deployments exposing the folder management API
Multi-user Open WebUI instances where authenticated accounts can create folders

Discovery Timeline

2026-09-09 - CVE-2026-87013 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database
Fix reference - Corrected in Open WebUI v0.11.1 release and GHSA-8r35-5x5r-hv74

Technical Details for CVE-2026-87013

Vulnerability Analysis

Open WebUI organizes user content into folders that reference a parent_id. The endpoint POST /api/v1/folders/{id}/update/parent did not validate that the requested parent was outside the folder's own subtree. An authenticated user could therefore set a folder's parent to itself or to a descendant, producing a cycle in what is expected to be a tree structure. The recursive routines that walk this structure did not track visited folder identifiers, so any traversal of the affected subtree ran without a termination condition.

The patch introduces two defenses. In backend/open_webui/models/folders.py, the recursive get_children helper now maintains a seen_ids set and skips folders already visited. In backend/open_webui/routers/folders.py, an is_in_parent_cycle check inspects the parent chain and rejects folders whose ancestry loops back on itself.

Root Cause

The root cause is missing acyclicity enforcement on parent assignment combined with unbounded recursion in folder traversal. The application trusted stored parent references without validating tree invariants at write time or at read time.

Attack Vector

Exploitation requires network reach to the Open WebUI API and a valid low-privilege authenticated session. The attacker issues a POST request to /api/v1/folders/{id}/update/parent to persist a cycle, then invokes DELETE /api/v1/folders/{id} or POST /api/v1/folders/{id}/read to trigger the runaway traversal. The malicious state persists in the database until an administrator repairs it.

python

# Patch: backend/open_webui/models/folders.py
# Prevents infinite recursion during folder tree traversal
try:
    async with get_async_db_context(db) as db:
        folders = []
        seen_ids = {id}

        async def get_children(folder):
            children = await self.get_folders_by_parent_id_and_user_id(folder.id, user_id, db=db)
            for child in children:
                if child.id in seen_ids:
                    continue
                seen_ids.add(child.id)
                await get_children(child)
                folders.append(child)

# Patch: backend/open_webui/routers/folders.py
# Detects folders whose parent chain loops back on itself
await check_folders_permission(request, user, db=db)

folders = await Folders.get_folders_by_user_id(user.id, db=db)
parent_by_id = {folder.id: folder.parent_id for folder in folders}

def is_in_parent_cycle(folder_id):
    seen_ids = {folder_id}
    current_id = parent_by_id.get(folder_id)
    while current_id and current_id not in seen_ids:
        seen_ids.add(current_id)
        current_id = parent_by_id.get(current_id)
    return current_id == folder_id

Source: GitHub commit 23b3a69

Detection Methods for CVE-2026-87013

Indicators of Compromise

Repeated POST /api/v1/folders/{id}/update/parent requests where the target parent belongs to the same user's folder subtree.
Worker processes stuck at high CPU utilization while servicing DELETE /api/v1/folders/{id} or POST /api/v1/folders/{id}/read.
Database rows in the folders table where a folder's parent_id chain resolves back to the folder's own id.

Detection Strategies

Query the folders table for cycles by walking parent_id references and flagging any folder whose ancestry contains its own identifier.
Alert on Open WebUI API request latency spikes correlated with the folder endpoints listed above.
Track authenticated users who invoke update/parent at abnormal rates or against many folder identifiers in a short window.

Monitoring Recommendations

Enable structured access logging on the Open WebUI reverse proxy and retain request paths, user identifiers, and response times.
Monitor container or process resource limits so a single runaway request cannot exhaust host memory.
Configure health checks that fail when worker threads exceed a bounded execution time on folder operations.

How to Mitigate CVE-2026-87013

Immediate Actions Required

Upgrade all Open WebUI deployments to version 0.11.1 or later.
Audit the folders table for existing cycles and repair any records where a folder is its own ancestor before restarting affected services.
Restrict folder API access to trusted authenticated users while patching is in progress.

Patch Information

The fix is delivered in Open WebUI 0.11.1. See GitHub commit 23b3a69, pull request #28748, and the GHSA-8r35-5x5r-hv74 advisory for full technical detail.

Workarounds

Place a reverse proxy rule that blocks or rate-limits POST /api/v1/folders/{id}/update/parent until the upgrade is applied.
Enforce per-request CPU and wall-clock timeouts on the Open WebUI backend so infinite traversals are terminated.
Periodically scan the folders table and reset the parent_id of any folder that participates in a cycle to NULL.

bash

# Upgrade Open WebUI to the patched release
pip install --upgrade 'open-webui==0.11.1'

# Container deployments
docker pull ghcr.io/open-webui/open-webui:0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  --memory=2g --cpus=2 \
  -p 3000:8080 \
  ghcr.io/open-webui/open-webui:0.11.1