CVE-2026-88000: Open WebUI DOS Vulnerability

CVE-2026-88000 Overview

Open WebUI is a self-hosted AI platform that provides an extensible interface for interacting with large language models. A denial-of-service vulnerability affects versions 0.10.0 through 0.11.0, tracked as CVE-2026-88000. The flaw resides in the chat message deletion endpoint DELETE /api/v1/chats/{id}/messages/{message_id}, which fails to track visited message identifiers when traversing chat history. An authenticated user can create a cyclic chat tree and trigger a synchronous infinite loop that blocks every user's requests until the process is terminated. The issue is fixed in version 0.11.1.

Critical Impact
An authenticated low-privilege user can render the entire Open WebUI instance unresponsive for all users by exploiting a single API call.

Affected Products

Open WebUI version 0.10.0
Open WebUI versions 0.10.x through 0.11.0
Fixed in Open WebUI version 0.11.1

Discovery Timeline

2026-09-09 - CVE-2026-88000 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-88000

Vulnerability Analysis

The vulnerability is an infinite loop condition classified under CWE-835 (Loop with Unreachable Exit Condition). The defect exists in the chat-history deletion helper located in backend/open_webui/models/chats.py. When a message is deleted, the helper walks the chat tree by following childrenIds references from one message node to the next.

The traversal loop never records which message identifiers it has already visited. If the chat tree contains a cycle where message A references message B as a child, and message B references message A, the traversal never terminates. Because the request is processed synchronously on the server request loop, the blocked thread prevents all other users from having their requests serviced.

Root Cause

The deletion helper contained a while child_ids: loop that unconditionally followed the last element of the childrenIds array without validating whether that identifier had already been processed. The chat tree structure is user-controlled and persisted, so an attacker can store a self-referencing or mutually-referencing message graph before triggering the deletion path.

Attack Vector

An authenticated user first submits chat data crafted to include a cyclic childrenIds reference chain. The attacker then issues a DELETE request against the affected endpoint. The server enters the traversal loop and consumes CPU indefinitely, starving the shared request loop and denying service to all other users of the platform.

python

# Patch from backend/open_webui/models/chats.py
            if current_id is None
            else messages.get(current_id, {}).get('childrenIds', [])
        )
-        while child_ids:
+        visited_ids = set()
+        while child_ids and child_ids[-1] not in visited_ids:
            current_id = child_ids[-1]
+            visited_ids.add(current_id)
            child_ids = messages.get(current_id, {}).get('childrenIds', [])
        history['currentId'] = current_id if current_id in messages else None
        return deleted_ids

Source: GitHub Commit b933292. The fix introduces a visited_ids set that records each processed identifier and terminates the loop when a revisit is detected.

Detection Methods for CVE-2026-88000

Indicators of Compromise

Open WebUI worker processes consuming 100% CPU on a single core following a DELETE /api/v1/chats/{id}/messages/{message_id} request.
Server request loop becoming unresponsive with all in-flight requests hanging until the process is killed and restarted.
Chat records in the datastore containing childrenIds arrays that reference ancestor message identifiers, forming cycles.

Detection Strategies

Monitor Open WebUI application logs for DELETE calls to /api/v1/chats/{id}/messages/{message_id} that are immediately followed by request timeouts across unrelated sessions.
Alert on sustained single-thread CPU saturation of the Open WebUI Python process without a corresponding increase in request throughput.
Perform integrity checks on stored chat trees to identify records where childrenIds traversal does not terminate within the expected message count.

Monitoring Recommendations

Track process-level CPU and request-latency metrics for the Open WebUI backend and page on sudden latency spikes correlated with chat API activity.
Enable structured audit logging for authenticated chat modification and deletion endpoints so that the responsible account can be identified during triage.
Deploy runtime workload telemetry on the host or container running Open WebUI to correlate CPU exhaustion events with the source API call.

How to Mitigate CVE-2026-88000

Immediate Actions Required

Upgrade Open WebUI to version 0.11.1 or later, which contains the fix from pull request #28035.
Restrict Open WebUI access to trusted authenticated users only until the upgrade is applied, since exploitation requires valid credentials.
Restart any Open WebUI worker process that becomes unresponsive to restore service for other users.

Patch Information

The fix is delivered in Open WebUI release v0.11.1 and merged via commit b933292d63d12be3fd1416fe55519ddc7aa336bc. Full details are documented in the GitHub Security Advisory GHSA-3cgp-3cqx-j8w2. The patch introduces cycle detection using a visited_ids set inside the chat-history traversal helper in backend/open_webui/models/chats.py.

Workarounds

Place Open WebUI behind a reverse proxy that enforces short server-side request timeouts, limiting the impact window of a stalled deletion call.
Run Open WebUI with multiple worker processes so that a single blocked worker does not starve the entire deployment.
Temporarily disable the chat deletion endpoint at the ingress layer for lower-trust user tiers until the upgrade to 0.11.1 is complete.

bash

# Upgrade Open WebUI to the patched release
pip install --upgrade open-webui==0.11.1

# Or for container deployments
docker pull ghcr.io/open-webui/open-webui:v0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.1