CVE-2026-88002: 
Python vulnerability analysis and mitigation

CVE-2026-88002 is a Denial of Service vulnerability in Open WebUI, a self-hosted AI platform, caused by an infinite loop in the chat message history reconstruction logic. Any authenticated user with the default role can trigger a non-terminating walk of the async event loop by storing a crafted cyclic chat history with id-less messages, effectively hanging the server for all users. The vulnerability affects Open WebUI versions >= 0.5.0 and < 0.11.1, and was fixed in version 0.11.1. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Feedly).

The root cause (CWE-835: Loop with Unreachable Exit Condition) lies in the get_message_list function within backend/open_webui/utils/misc.py. The function traversed chat history by map key but tracked visited entries using each message body's optional id field — two different notions of identity. When a message omitted the id field, the cycle-detection guard never recorded it as visited, making the exit condition unreachable. Because the write path performs no structural validation of chat history JSON, an attacker could POST a crafted payload with two messages referencing each other as parents (a cycle) and with the id field omitted, which was persisted verbatim. The fix in commit 5c79ccc changes the visited set to track the map key rather than the message's self-reported id, ensuring termination after at most one step per stored message (Github Advisory, Fix PR, Fix Commit).

Successful exploitation blocks the asyncio event loop entirely, causing every request from every user — including unauthenticated /health checks and administrator API calls — to time out for as long as the process runs. Memory consumption grows without bound (observed at 1.86 GB resident within 60 seconds in testing), leading to an out-of-memory kill on memory-capped deployments. Critically, the malformed chat persists in the database, so restarting the process does not restore service; the next request that walks the stored chat hangs the new process identically, requiring manual deletion of the offending chat record for recovery. No confidentiality or integrity impact occurs — no data is disclosed, altered, or deleted (Github Advisory).

No public proof-of-concept exploit code has been published beyond the minimal payload included in the official security advisory itself, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only a valid account with the default user role — no administrator rights, additional permissions, or special configuration are needed, making the attack surface broad on any multi-user Open WebUI deployment (Github Advisory, Feedly).

1. Obtain a default-role account: Register or log in to the target Open WebUI instance with any standard user account — no elevated privileges are required.
2. Craft the malicious payload: Construct a chat JSON object containing two messages that reference each other as parents, with the id field deliberately omitted from both message bodies:

{"chat":{"title":"poc","history":{"currentId":"A","messages":{
  "A":{"parentId":"B","role":"user","content":"a","childrenIds":[]},
  "B":{"parentId":"A","role":"assistant","content":"b","childrenIds":[]}}}}}

3. Store the malicious chat: Send the payload via POST /api/v1/chats/new with a valid authentication token. The server accepts and persists the malformed history verbatim without validation.
4. Trigger the infinite loop: Issue a single GET /api/v1/chats/stats/usage request as the same user. This triggers the get_message_list walk, which enters an infinite loop and never returns.
5. Disconnect and observe impact: The attacker can immediately disconnect — the walk is not cancelled on client disconnect. The server's async event loop is now blocked, causing all other users' requests (including /health and admin endpoints) to time out.
6. Persistence across restarts: The malformed chat remains in the database. Any process restart will re-hang on the next request that walks the stored chat, maintaining the denial of service until an administrator manually deletes the offending chat record (Github Advisory).

• Network: Requests to POST /api/v1/chats/new with a JSON body containing messages that have parentId fields forming a cycle and no id field on message bodies; subsequent GET /api/v1/chats/stats/usage or similar history-walking endpoints that never return a response.
• Logs: Application logs showing the asyncio event loop blocked or unresponsive; health check endpoints (/health) returning timeouts or connection errors; all API endpoints timing out simultaneously.
• Process: The Open WebUI worker process consuming 100% of a single CPU core continuously; resident memory growing rapidly (e.g., exceeding 1 GB within 60 seconds) without a corresponding increase in legitimate user activity.
• Database: Presence of a chat record in the database whose history.messages map contains entries with parentId values forming a cycle and message bodies lacking an id field (Github Advisory).

The primary remediation is to upgrade Open WebUI to version 0.11.1 or later, which fixes the walk logic in backend/open_webui/utils/misc.py (commit 5c79ccc). Upgrading also neutralizes any malicious chats already stored in the database, as the corrected walk terminates normally on them. As interim measures, administrators should restrict chat creation and modification to trusted users only, implement memory monitoring with automatic process restart to limit downtime duration, and audit the database for existing chat records with cyclic parentId references and no id field, deleting any found (Github Advisory, Release v0.11.1).