CVE-2026-88002— Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
Quick assessment
Affected
open-webui open-webui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Open WebUI 是一个可扩展、功能丰富且用户友好的自托管 AI 平台。 在 0.5.0 至 0.11.1 版本中，位于 中的“消息链重建”辅助函数在遍历聊天历史记录时，通过 map 键进行推进，但使用每条消息主体中的可选 字段来跟踪已访问的条目。认证用户可以通过在父级循环（parent cycle）中存储无 的消息，从而触发一个非终止的遍历过程。该过程会阻塞异步事件循环，导致内存持续增长直至进程结束，并且在进程重启后仍会持续存在。此问题已在 0.11.1 版本中修复。
Possible ATT&CK Techniques 1 AI
T1015
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88002
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
Source: CVE Program / CVE List V5
Vulnerability Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-webui | open-webui | >= 0.5.0, < 0.11.1 | - |
|
II. Public POCs for CVE-2026-88002
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88002
请登录查看更多情报信息。
Other References for CVE-2026-88002 (3)
-
https://github.com/open-webui/open-webui/pull/28034 x_refsource_MISC
-
https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6 x_refsource_CONFIRM
Same Patch Batch · open-webui · 2026-09-09 · 16 CVEs total
| CVE-2026-87995 | 8.7 HIGH | Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcodin |
| CVE-2026-87016 | 8.1 HIGH | Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on |
| CVE-2026-87996 | 7.7 HIGH | Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader |
| CVE-2026-87011 | 7.5 HIGH | Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in bac |
| CVE-2026-87998 | 7.1 HIGH | Open WebUI: Non-admin users can delete admin-owned external knowledge connections via know |
| CVE-2026-87999 | 7.1 HIGH | Open WebUI: Any authenticated user can reach the Azure platform channel via server-side we |
| CVE-2026-87015 | 6.8 MEDIUM | Open WebUI: A user's session cookies are sent to tool servers configured for bearer authen |
| CVE-2026-87014 | 6.5 MEDIUM | Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' |
| CVE-2026-88000 | 6.5 MEDIUM | Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic ch |
| CVE-2026-88001 | 5.0 MEDIUM | Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redi |
| CVE-2026-87012 | 4.3 MEDIUM | Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-nu |
| CVE-2026-87013 | 4.3 MEDIUM | Open WebUI: Any authenticated user can start a non-terminating request via a folder parent |
| CVE-2026-87017 | 4.3 MEDIUM | Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool o |
| CVE-2026-87994 | 4.3 MEDIUM | Open WebUI: Channel members can overwrite another member's message via the chat completion |
| CVE-2026-87997 | 4.3 MEDIUM | Open WebUI: Any authenticated user can inject chats into another user's folder via chat co |
IV. Related Vulnerabilities
Same product: open-webui
-
CVE-2026-88001
Open WebUI: Server-side fetches reach blocked and internal h -
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via m -
CVE-2026-87999
Open WebUI: Any authenticated user can reach the Azure platf -
CVE-2026-87998
Open WebUI: Non-admin users can delete admin-owned external -
CVE-2026-87997
Open WebUI: Any authenticated user can inject chats into ano
Same vendor: open-webui
-
CVE-2026-88001
Open WebUI: Server-side fetches reach blocked and internal h -
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via m -
CVE-2026-87999
Open WebUI: Any authenticated user can reach the Azure platf -
CVE-2026-87998
Open WebUI: Non-admin users can delete admin-owned external -
CVE-2026-87997
Open WebUI: Any authenticated user can inject chats into ano
Same weakness: CWE-835
-
CVE-2026-88000
Open WebUI: Any authenticated user can hang the server via m -
CVE-2026-87013
Open WebUI: Any authenticated user can start a non-terminati -
CVE-2026-6554
infinte loop in libpcap before 1.10.7 -
CVE-2026-78543
IBM App Connect Enterprise and IBM Integration Bus for z/OS -
CVE-2026-84309
pypdf: Possible infinite loop for TreeObject.insert_child
V. Comments for CVE-2026-88002
No comments yet