CVE-2026-87011 open-webui CVE debrief

Who should care

Defenders responsible for Open WebUI instances, especially those with ENABLE_OAUTH_BACKCHANNEL_LOGOUT enabled, should assess exposure and apply the fix to prevent potential instance availability issues.

Why it matters

CVE-2026-87011 is a high-severity vulnerability in Open WebUI that can impact instance availability and amplify traffic to the identity provider. Defenders should prioritize verifying exposure and applying the fix.

• Instance availability may be impacted due to stalling of the single-worker instance.
• Traffic to the identity provider may be amplified, potentially leading to increased load.

Technical summary

The unauthenticated POST /oauth/backchannel-logout handler in Open WebUI fetched the OIDC discovery document and signing keys before validating a submitted logout token, potentially stalling the instance and amplifying traffic to the identity provider. This issue is fixed in version 0.11.1. The vulnerability can impact instance availability and amplify traffic to the identity provider. Defenders should prioritize verifying exposure and applying the fix, as the vulnerability can impact instance availability and potentially lead to increased load on the identity provider.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, as the vulnerability can impact instance availability.

Recommended defensive actions

• Verify if the Open WebUI instance is exposed to the internet and if the ENABLE_OAUTH_BACKCHANNEL_LOGOUT feature is enabled.
• Check if the instance is running version 0.11.1 or later.
• Monitor instance performance and traffic to detect potential amplification attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The issue is fixed in version 0.11.1. Affected versions are from 0.9.0 until 0.11.1. Details on affected versions are limited, and defenders should verify exposure. The CVE record was published on 2026-09-09T21:17:05.847Z and has not been modified since then. The fix involves updating to version 0.11.1 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.