CVE-2026-70489 open-webui CVE debrief

Who should care

Open WebUI users and administrators should be aware of this issue and take necessary actions to prevent potential availability impact. This includes reviewing and updating automation recurrence parsing configurations, monitoring instance performance, and prioritizing patching to version 0.11.0 or later. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators of Open WebUI instances should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Platform administrators should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Asset inventory managers should check relevant monitoring, detection, and logs for exposed assets that need extra review. Those responsible for change management should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also consider rollback/change windows for remediation efforts. Source tracking should be implemented to monitor for similar issues in the future. Compensating controls should be reviewed to mitigate potential impact while patching is in progress. Monitoring should be enhanced to detect any potential exploitation attempts or performance issues related to this vulnerability. Asset owners should be notified and involved in the remediation process. Security teams should also consider implementing additional security measures such as limiting access to sensitive areas of the Open WebUI instance until patching can be completed. Communication plans should be developed to inform stakeholders about the issue and remediation progress. Post-remediation reviews should be conducted to assess the effectiveness of the response and identify areas for improvement. Lessons learned from this incident should be incorporated into future vulnerability management processes to enhance overall security posture. IT operations teams should be prepared to handle potential

Technical summary

Open WebUI's automation recurrence parsing issue causes availability impact due to synchronous enumeration of occurrences on the event loop that also serves scheduler, HTTP, and WebSocket traffic. The scheduler recomputes the next run for every claimed row on each poll, leading to performance issues. This issue is fixed in version 0.11.0, where the parsing logic was updated to prevent such synchronous enumeration.

Defensive priority

Open WebUI users should prioritize patching to prevent potential availability impact.

Recommended defensive actions

• Patch Open WebUI to version 0.11.0 or later
• Review and update automation recurrence parsing configurations
• Monitor instance performance and user impact
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-70489 issue arises from Open WebUI's automation recurrence parsing in backend/open_webui/utils/automations.py, which causes availability impact for every other user of the instance. Evidence is based on official CVE and NVD records. The issue has a CVSS score of 6.5 and a severity of MEDIUM. Open WebUI users and administrators should be aware of this issue and take necessary actions to prevent potential availability impact. The issue is fixed in version 0.11.0. To verify, defenders should review the official CVE record, assess their instance's version, and monitor for potential impact.

Official resources