CVE-2026-88002: Open WebUI Denial of Service Vulnerability

CVE-2026-88002 Overview

CVE-2026-88002 is a denial-of-service vulnerability in Open WebUI, a self-hosted AI platform. The flaw resides in the message-chain reconstruction helper located in backend/open_webui/utils/misc.py. Versions from 0.5.0 up to 0.11.1 track visited chat messages using each message body's optional id field rather than the map key. An authenticated user can store id-less messages arranged in a parent cycle, triggering a non-terminating walk. The infinite loop blocks the async event loop, grows memory until process termination, and persists across restarts because the malformed data remains in storage. The issue is resolved in version 0.11.1.

Critical Impact
An authenticated attacker can persistently deny service to the Open WebUI instance by poisoning chat history with cyclic, id-less messages that trigger an infinite loop each time the record is loaded.

Affected Products

Open WebUI versions 0.5.0 through 0.11.0
Self-hosted deployments running the affected misc.py helper
Any multi-user Open WebUI instance permitting authenticated chat creation

Discovery Timeline

2026-09-09 - CVE-2026-88002 published to NVD
2026-09-09 - Last updated in NVD database
Fix released in Open WebUI version 0.11.1 via GitHub Pull Request #28034

Technical Details for CVE-2026-88002

Vulnerability Analysis

The vulnerability is an infinite loop condition [CWE-835] in the chat history walker. The get_message_list helper traverses messages by following each entry's parentId through a messages_map dictionary. The loop's cycle detection relies on the message body's optional id attribute rather than the map key used for lookup.

When an authenticated user submits messages where the id field is omitted, the visited-set never records the actual traversal position. The walker follows parentId references indefinitely if those references form a cycle. Because Open WebUI is built on an async web framework, the blocking loop stalls the event loop and prevents other requests from being served. Memory consumption grows as message_list.append(current_message) accumulates entries until the process is killed.

Crucially, the malicious chat record is persisted in storage. Every subsequent load of the affected conversation retriggers the loop, making the denial-of-service condition survive process restarts.

Root Cause

The root cause is inconsistent identity tracking. The messages_map is keyed by one identifier while cycle detection uses a different, optional field on the value. When the value-side id is None, the visited set is never meaningfully updated, and the termination condition can never be met on a cyclic graph.

Attack Vector

An authenticated user with permission to create or modify chats submits a crafted chat structure containing messages with omitted id values and parentId references forming a cycle. Any subsequent access that invokes the message-chain reconstruction helper triggers the loop.

python

     message_list = []
     visited_message_ids = set()
 
-    while current_message:
-        message_id = current_message.get('id')
-        if message_id in visited_message_ids:
-            # Cycle detected, break to prevent infinite loop
-            break
-
-        if message_id is not None:
-            visited_message_ids.add(message_id)
-
+    # Track the map keys, not the messages' own 'id' field: a message may omit it
+    while current_message and message_id not in visited_message_ids:
+        visited_message_ids.add(message_id)
         message_list.append(current_message)
-        parent_id = current_message.get('parentId')  # Use .get() for safety
-        current_message = messages_map.get(parent_id) if parent_id else None
+
+        message_id = current_message.get('parentId')
+        current_message = messages_map.get(message_id) if message_id else None
 
     message_list.reverse()
     return message_list

Source: GitHub Commit 5c79ccc9. The patch replaces reliance on the message body's id field with the map key used for traversal, ensuring the visited set always tracks the actual iteration cursor.

Detection Methods for CVE-2026-88002

Indicators of Compromise

Open WebUI worker processes consuming steadily increasing memory until termination by the OS or container runtime
Repeated worker restarts triggered whenever a specific chat is loaded
Stored chat records containing messages with missing id fields and cyclic parentId references
Unresponsive Open WebUI API endpoints while a single async task remains stuck in get_message_list

Detection Strategies

Scan the chat database for messages where the id field is absent or null and parentId references form a cycle within the same conversation
Instrument backend/open_webui/utils/misc.py with iteration counters and log any traversal exceeding a reasonable message-chain depth
Alert on Open WebUI container restarts correlated with out-of-memory events

Monitoring Recommendations

Track process memory and event-loop lag metrics for Open WebUI workers and alert on sustained upward trends
Log the user, chat ID, and request path preceding any worker termination to attribute abuse to a specific account
Enable audit logging on chat create and update endpoints to identify accounts submitting malformed message payloads

How to Mitigate CVE-2026-88002

Immediate Actions Required

Upgrade Open WebUI to version 0.11.1 or later, which contains the fix from Pull Request #28034
Identify and delete any stored chat records containing cyclic parentId references with missing id fields before restarting workers
Restrict account creation and review authenticated user permissions on internet-exposed Open WebUI deployments

Patch Information

The fix is included in Open WebUI release v0.11.1. Details are documented in GHSA-jqhh-cjmq-vmv6. The patched walker tracks the messages_map key used for traversal rather than the optional id field on the message body, guaranteeing termination on cyclic input.

Workarounds

Apply the upstream patch to backend/open_webui/utils/misc.py if immediate upgrade is not possible
Add server-side validation rejecting message submissions that omit the id field or that create cyclic parentId relationships
Place Open WebUI behind an authenticated reverse proxy and limit chat creation to trusted users pending remediation

bash

# Upgrade Open WebUI to the fixed release
pip install --upgrade 'open-webui>=0.11.1'

# Or, for Docker deployments
docker pull ghcr.io/open-webui/open-webui:0.11.1
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 ghcr.io/open-webui/open-webui:0.11.1