Vulnerability Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/open-webui/open-webui/commit/c4ae8c86786fed521960466f6d8eef8a
- https://github.com/open-webui/open-webui/releases/tag/v0.11.0
- https://github.com/open-webui/open-webui/security/advisories/GHSA-73cq-mcgh-379c
- https://github.com/open-webui/open-webui/security/advisories/GHSA-73cq-mcgh-379c
FAQ
What is CVE-2026-70489?
CVE-2026-70489 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutel...
How severe is CVE-2026-70489?
CVE-2026-70489 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-70489?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.