Open WebUI CVE-2026-109299

Exploitation requires an authenticated account that has been granted the 'automations' permission within Open WebUI (versions 0.9.0 up to but not including 0.11.4); it is not exploitable by anonymous or unauthenticated users. The attacker must send recurrence rules (RRULE) that are syntactically parseable but unsatisfiable - the description's canonical example is a rule resolving to a nonexistent date like February 30th - to the automations create or update endpoints. Each such rule causes recurrence evaluation to block the single shared async event loop for seconds per request, so sustained impact requires repeated submission. Limiting factors: the automations permission requirement (non-anonymous, operator-granted), the availability-only impact (no data exposure or code execution), and the recoverable nature of the stall (service resumes once requests stop).

This is a genuine but moderate-priority issue rather than a critical one. The CVSS 4.0 score of 7.1 is driven entirely by availability impact (VA:H) with no confidentiality or integrity consequences (VC:N/VI:N); the vector is network-reachable (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but crucially requires authenticated low-privilege access (PR:L) AND the specific 'automations' permission, which meaningfully narrows the attacker population to trusted/provisioned users rather than anonymous internet attackers. No EPSS score was provided in the input, so exploitation-probability modeling cannot be incorporated - this is a data gap. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is not confirmed actively exploited. The SSVC-style read is: technical impact is partial (availability-only, recoverable DoS), exploitation is not observed, and automatability is low because an authenticated permissioned account is a prerequisite. Net: a real availability risk for multi-tenant or shared Open WebUI deployments where the event loop is contended, but not an emergency drop-everything patch for single-user or trusted-team instances. The CVSS and description are internally consistent (both point to authenticated availability-only DoS), so no conflicting signals to flag here.

An authenticated Open WebUI user who holds the 'automations' permission repeatedly POSTs/updates automations containing an unsatisfiable recurrence rule (e.g. one resolving to February 30th) to the automations create or update endpoints. Each submission forces synchronous recurrence evaluation that blocks the shared async event loop for several seconds, so a rapid burst of such requests stalls the instance and degrades service for all other users. No public proof-of-concept exploit has been identified at time of analysis.