CVE-2026-87013: CVE-2026-87013: Denial of Service via Cyclic Folder Structures in Open WebUI

#security #cve #cybersecurity

CVE-2026-87013: Denial of Service via Cyclic Folder Structures in Open WebUI

Vulnerability ID: CVE-2026-87013
CVSS Score: 4.3
Published: 2026-09-10

An authenticated denial of service vulnerability exists in Open WebUI versions 0.10.0 through 0.11.0. An attacker can update a folder's parent identifier to establish cyclic folder references, causing recursive tree-walking operations to execute infinitely, leading to CPU exhaustion and localized application denial of service.

TL;DR

Authenticated users can create self-referencing folder loops in Open WebUI, triggering an infinite recursion that consumes 100% CPU and causes a Denial of Service.

Technical Details

CWE ID: CWE-835
Attack Vector: Network
CVSS Severity: 4.3 (Medium)
EPSS Score: 0.00268 (Percentile: 18.84%)
Impact: Denial of Service (DoS) via Thread Exhaustion
Exploit Status: No Public PoC / No Active Exploitation
CISA KEV Status: Not Listed

Affected Systems

Open WebUI
open-webui: >= 0.10.0, < 0.11.1 (Fixed in: 0.11.1)

Mitigation Strategies

Upgrade Open WebUI to version v0.11.1 or above.
Apply database queries to detect and clear circular dependencies manually.
Configure reverse proxy or WAF rules to validate and drop self-referential parent updates.

Remediation Steps:

Pull the latest Docker image of Open WebUI (v0.11.1 or newer).
Run the recursive CTE SQL script against the backend database to check for existing folder cycles.
Update any corrupt database rows by setting the parent_id to NULL, breaking cycles.
Deploy custom WAF filter rule to detect matching parent_id and path ID variables on update endpoints if quick upgrade is unfeasible.

References

Read the full report for CVE-2026-87013 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community