CVE-2026-88002: Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

The helper in backend/open_webui/utils/misc.py rebuilds a chat's message chain by following parentId through the history map. It tracked visited messages by the id field inside each message body, and it skipped recording a message with no id. A message that omits id is never marked visited, so a parent cycle between two such messages never ends.

Any account with the default user role can store this chat with POST /api/v1/chats/new, since the write path does not validate history structure. Anything that rebuilds the history then triggers the loop: chat completion, per-chat statistics such as GET /api/v1/chats/stats/usage, context compaction, subagents and timers.

The walk runs on the asyncio event loop, so /health, admin endpoints and every other user's requests time out. The list it appends to grows without bound. In the proof of concept the worker reached 1.86 GB within 60 seconds, so a memory-capped deployment ends in an out-of-memory kill. The request is not cancelled when the client disconnects. The bad chat stays in the database, so a restart hangs again on the next request that walks it. Recovery means deleting the stored chat. No data is exposed.

All builds from 0.5.0 up to and including 0.11.0. No special configuration is needed: creating a chat is available to every user by default.

pip show open-webui

For Docker, check the image tag. Even instances where all users are trusted are affected, though exploitation then needs a deliberate action.

Upgrade to 0.11.1.

pip install --upgrade open-webui

Commit 5c79ccc fixes the walk to record the map key it is currently at instead of the message's self-reported id. It now ends after at most one step per stored message. Chats already stored with cycles become harmless, so you do not need to clean them out. The advisory lists no workaround.

Watch for a worker at one full core with climbing memory, failing /health checks, and a process that hangs again right after a restart. Check logs for a POST /api/v1/chats/new from a regular user followed by a request that never returns, such as GET /api/v1/chats/stats/usage or a chat completion.

Inspect stored chat history for messages whose parentId values point at each other and that lack an id field. Deleting the stored chat restores service on an unpatched instance.

Summary

Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat's message chain detected repeats using each message's own id field while moving through the history by map key, so a message that simply omitted id was never recorded as visited. A history whose messages referenced each other in a parent cycle therefore made the walk run forever. Any account with the default user role could store such a chat and trigger the walk, blocking the server for everyone.

Preconditions

One account with the default user role. No administrator rights, no additional permissions, no configuration change and no non-default setting: creating a chat is available to every user out of the box. The attack runs entirely against the attacker's own chat, so no knowledge of any other user's data is needed. Instances where every account is trusted are affected in the sense that the fault is reachable, but require a user acting deliberately.

Impact

The walk is synchronous and runs on the asyncio event loop, so while it spins, every request from every user is blocked, including unauthenticated /health and administrator endpoints. External health checks and orchestrator liveness probes fail alongside the UI. The list it appends to grows without bound, so a memory-capped deployment ends in an out-of-memory kill rather than a hang. The work is not cancelled when the client disconnects, so one fire-and-forget request is enough and the attacker can disconnect immediately. The malformed chat stays in the database, so restarting the process does not clear the condition: the next request that walks that chat hangs the new process, and recovery requires deleting the stored chat. No data is disclosed, altered or deleted.

Fix

Fixed in 0.11.1 by https://github.com/open-webui/open-webui/commit/5c79ccc9e5c9efc2bc024d8f0b9757652ece929a. The walk now records the map key it is currently positioned at instead of the message's self-reported id, so it terminates after at most one step per stored message whatever the message contents are. Upgrading fully resolves the issue, including for chats stored while the deployment was on an affected version, which become harmless once the walk terminates.

Root cause

Affected component: the message-chain reconstruction helper in backend/open_webui/utils/misc.py, reached from every path that rebuilds a chat's history, including chat completion, per-chat statistics, context compaction, subagents and timers. Affected setup: all builds from 0.5.0 up to and including 0.11.0.

The loop's visited set was keyed on the message body's id field while the loop itself advanced by looking the parent up as a key in the history map, so the two used different notions of identity. That id field is part of the stored chat object and is fully attacker-controlled, and the guard explicitly skipped recording it when absent, which left the exit condition unreachable for any message that omitted it. The write path does not validate the structure of a chat's history, so a history containing id-less messages in a parent cycle was persisted exactly as submitted.

Proof of concept

As a default-role user on a running instance, store one chat of two messages that reference each other as parents, with the id field omitted:

{"chat":{"title":"poc","history":{"currentId":"A","messages":{
  "A":{"parentId":"B","role":"user","content":"a","childrenIds":[]},
  "B":{"parentId":"A","role":"assistant","content":"b","childrenIds":[]}}}}}

POST /api/v1/chats/new stores it verbatim. A single subsequent GET /api/v1/chats/stats/usage as the same user then never returns. Sampled during the hang, the worker consumed one full CPU core and reached 1.86 GB resident within 60 seconds, still growing. Unauthenticated GET /health and administrator API calls both time out for as long as the process lives, and continue to do so after the attacker's connection closes. Restarting the server restores service until the first request that walks the stored chat, which hangs the new process the same way.

On 0.11.1 the same payload returns promptly, /health stays available throughout, and a well-formed chat still resolves its full history.

Credits

@YashvantHange, who reported the missing-id cycle in the message-chain walk, demonstrated the resulting server-wide outage end to end against a live instance, and showed that it survives both attacker disconnect and a process restart.