PYPI · SEPTEMBER 2026 · EARLY WARNING

Open WebUI Vulnerability: Authenticated User Can Hang Server

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
open webui (pypi)
Patched version
0.11.1
GHSA-3CGP-3CQX-J8W2

An early warning has been issued for a high severity vulnerability in Open WebUI. Any authenticated user can reportedly hang the server via message deletion in a cyclic chat tree.

What happened

The vulnerability, tracked as GHSA-3cgp-3cqx-j8w2, allows any authenticated user to hang the server by deleting messages in a cyclic chat tree. This causes the server's request loop to block, preventing other users from making requests until the process is killed. The issue is under investigation and has not been exploited in the wild.

Affected versions of Open WebUI are those below 0.11.1. The vulnerability was first flagged on September 9, 2026. The recommended action is to upgrade to Open WebUI version 0.11.1 or later.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If open webui is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are running Open WebUI version below 0.11.1.

What should I do right now?

Upgrade to Open WebUI version 0.11.1 or later.

Has this been exploited in the wild?

No, this vulnerability has not been exploited in the wild.

Sources

Join the 0Day waitlist →

← Back to all threats