Open WebUI CVE-2026-109295

Exploitation requires a valid authenticated account (CVSS PR:L) on the Open WebUI instance and the ability to make the model invoke the grep_knowledge_files or grep_chat_files tool with an attacker-controlled regular expression; these knowledge/chat file-search tools must be reachable for the logged-in user. The core limiting factor is authentication - this is not anonymously exploitable - so realistic risk is highest on multi-tenant, shared-account, or self-service-registration deployments where untrusted users hold accounts. A further limiter is that impact is transient and must be sustained by repeated calls (roughly two seconds of worker blocking per call), so a single request causes only a brief stall rather than durable outage. Affected versions are 0.11.0 through 0.11.3 (fixed in 0.11.4).

This is a moderate-severity availability vulnerability (CVSS 4.0 base 7.1) with signals that point to a real but bounded operational risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring only low-privileged authentication (PR:L) - i.e. any logged-in user - with impact limited strictly to availability of the vulnerable system (VA:H; VC:N/VI:N - no data confidentiality or integrity loss). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization; exploitation status is best characterized as no public exploit identified at time of analysis. The practical ceiling on severity is that each malicious call stalls a worker for roughly two seconds and must be repeated to sustain denial of service, meaning a determined authenticated attacker can degrade or stall the service but the attack is noisy, repetitive, and requires a valid account - making this a credible insider/abuse-of-access and multi-tenant concern rather than an anonymous internet-wide threat. CONFLICTING/MISSING SIGNAL: no EPSS or KEV data was supplied, so widespread-exploitation probability cannot be quantified; treat this as a patch-in-normal-cycle item unless the instance exposes self-service or shared accounts.

An authenticated Open WebUI user (or a compromised low-privilege account on a shared/multi-tenant instance) instructs the model to invoke the grep_knowledge_files or grep_chat_files tool with a crafted catastrophically-backtracking regular expression. The regex evaluation blocks the asyncio event loop for about two seconds per call, and by repeating the request the attacker holds server workers hostage, degrading or stalling the service for all users. No public exploit code was identified at time of analysis, but the technique is trivial to reproduce given tool access.