Open WebUI Vulnerability: Authenticated User Can Hang Server
- Severity
- HIGH
- Affected component
- open webui (pypi)
- Patched version
- 0.11.1
An early warning has been issued for a high severity vulnerability in Open WebUI. Any authenticated user can reportedly hang the server via message deletion in a cyclic chat tree.
What happened
The vulnerability, tracked as GHSA-3cgp-3cqx-j8w2, allows any authenticated user to hang the server by deleting messages in a cyclic chat tree. This causes the server's request loop to block, preventing other users from making requests until the process is killed. The issue is under investigation and has not been exploited in the wild.
Affected versions of Open WebUI are those below 0.11.1. The vulnerability was first flagged on September 9, 2026. The recommended action is to upgrade to Open WebUI version 0.11.1 or later.
What to do about it
- Check your Open WebUI installation version.
- If you are running a version below 0.11.1, upgrade to version 0.11.1 or later.
- Monitor the Open WebUI GitHub advisories for updates on this vulnerability.
- Consider implementing additional monitoring and alerting for unusual server behavior.
How 0Day would have caught this
open webui is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are running Open WebUI version below 0.11.1.
What should I do right now?
Upgrade to Open WebUI version 0.11.1 or later.
Has this been exploited in the wild?
No, this vulnerability has not been exploited in the wild.
Sources
- [GHSA-2724-6cpj-gf3v] Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
- [GHSA-34r3-9m95-vq73] Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
- [GHSA-3cgp-3cqx-j8w2] Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
- [GHSA-3g9q-v48f-hh9w] Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
- [GHSA-3pf7-q2g3-wj28] Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
- [GHSA-4qg5-cxx4-g927] Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange
- [GHSA-4v28-j6q3-5m4r] Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader