CVE-2026-88000: 
Python vulnerability analysis and mitigation

CVE-2026-88000 is a Denial of Service vulnerability in Open WebUI, a self-hosted AI platform, caused by an infinite loop in the chat message deletion endpoint. Any authenticated user with the default role can craft a cyclic chat tree and trigger a server-wide hang by deleting a message, blocking all other users' requests until the process is killed. The vulnerability affects Open WebUI versions >= 0.10.0 and < 0.11.1; versions before 0.10.0 are unaffected as the relevant endpoint did not exist. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, GitHub Security Advisory). The advisory was published on August 29, 2026, and the fix was released in version 0.11.1.

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The vulnerable component is the delete_message_from_history helper function in backend/open_webui/models/chats.py, invoked via DELETE /api/v1/chats/{id}/messages/{message_id}. When resolving the chat's new current message after a deletion, the code descends through childrenIds links without tracking already-visited message identifiers, allowing a cycle (e.g., message B lists message A as a child, and A lists B) to cause an infinite loop. Because the walk is synchronous and runs on the asyncio event loop, it monopolizes one CPU core and blocks all server requests — including unauthenticated /health checks — until the process is forcibly terminated. The write path does not validate chat history structure, so a malformed cyclic chat can be stored verbatim via POST /api/v1/chats/new (Github Advisory, Fix Commit).

Successful exploitation causes a complete availability outage for all users of the affected Open WebUI instance. The infinite loop pins one CPU core at 100% with flat memory usage, meaning the process cannot be reclaimed by an OOM killer and must be manually killed. All requests — including those from administrators and unauthenticated health checks — are blocked for the duration, causing orchestrator liveness probes and external monitoring to fail. Because the malformed chat persists in the database, the denial-of-service condition re-arms on any subsequent deletion attempt against that chat, even after a restart. There is no confidentiality or integrity impact; no data is disclosed, altered, or deleted (Github Advisory).

A proof-of-concept payload is publicly documented in the official security advisory, requiring only a ~300-byte JSON chat object with circular childrenIds references. No exploit kits or weaponized tools have been observed, and there is no evidence of in-the-wild exploitation as of the advisory date. The attack requires only a standard authenticated user account (the default role) with no elevated privileges, no special configuration, and no knowledge of other users' data. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Obtain an account: Register or log in to the target Open WebUI instance (versions 0.10.0–0.11.0) with any default-role user account — no administrator privileges are required.
2. Craft a cyclic chat payload: Construct a JSON chat object (~300 bytes) where messages reference each other as children, forming a cycle. Example payload:

{"chat":{"title":"poc","history":{"currentId":"C","messages":{
  "A":{"id":"A","parentId":null,"role":"user","content":"a","childrenIds":["B","C"],"timestamp":1},
  "B":{"id":"B","parentId":"A","role":"assistant","content":"b","childrenIds":["A"],"timestamp":2},
  "C":{"id":"C","parentId":"A","role":"user","content":"c","childrenIds":[],"timestamp":3}}}}}

3. Store the malicious chat: Send the payload via POST /api/v1/chats/new with a valid session token. The server stores the cyclic structure verbatim without validation.
4. Trigger the infinite loop: Send DELETE /api/v1/chats/{id}/messages/C (targeting message C, which forces the server to resolve the new current message by walking childrenIds). The walk enters an infinite loop between messages A and B.
5. Achieve denial of service: The server's asyncio event loop is blocked; all subsequent requests from all users time out. The attacker can disconnect immediately — the loop continues until the process is killed. The malicious chat remains in the database, allowing the attack to be re-triggered after a restart (Github Advisory, GitHub Security Advisory).

• Network: Unanswered or timed-out HTTP requests to GET /health (returning HTTP 000 or connection timeout) from monitoring systems or load balancers; a single DELETE /api/v1/chats/{id}/messages/{message_id} request that never returns a response.
• Process: One Open WebUI worker process consuming 100% of a single CPU core continuously with flat (non-growing) resident memory; the process does not respond to normal shutdown signals and must be killed.
• Logs: Access logs showing a DELETE /api/v1/chats/{id}/messages/{message_id} request with no corresponding response log entry; subsequent requests from all users logging connection timeouts or HTTP 000 errors; asyncio event loop stall warnings if instrumented.
• Database: A chat record in the database whose history.messages JSON contains childrenIds forming a cycle (e.g., message B's childrenIds includes message A, and A's childrenIds includes B) (Github Advisory, GitHub Security Advisory).

The definitive fix is to upgrade Open WebUI to version 0.11.1 or later, which resolves the issue for all existing chats including those stored while running a vulnerable version (v0.11.1 Release, Fix Commit). The fix (commit b933292) adds a visited_ids set to the delete_message_from_history walk, ensuring termination after at most one step per stored message. As a temporary workaround if immediate patching is not possible, restrict access to the DELETE /api/v1/chats/{id}/messages/{message_id} endpoint via a reverse proxy or WAF, or limit which authenticated users can perform chat deletions. Any cyclic chat records already in the database should be identified and removed to prevent re-triggering after upgrade.

The vulnerability was discovered and responsibly disclosed by researcher @Classic298, who also supplied the fix via pull request #28035. The advisory was published by the Open WebUI maintainers on August 29, 2026, and the fix was merged on August 17, 2026, ahead of the public disclosure. No significant broader media coverage or notable community debate has been observed beyond the standard advisory publication (Github Advisory).