CVE-2026-87013: Open WebUI infinite loop via folder parent cycle

CVE-2026-87013 · Severity: medium · CVSS 4.3 · Published 2026-09-09

Open WebUI's folder management feature allows authenticated users to organize documents and conversations into folders. An attacker can exploit a missing validation in the folder-move operation to create a circular folder structure (a folder parented to itself). This causes subsequent folder operations to hang indefinitely in an infinite loop, consuming CPU and memory resources. While the application remains responsive to other users in the short term, sustained attacks or unattended instances degrade over hours, potentially leading to service unavailability.

Technologies: open-webui (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-87013 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87013 being exploited in the wild.
How severe is CVE-2026-87013?
Medium severity, with a CVSS score of 4.3, published 9 September 2026.
Which products and versions are affected?
open-webui (PyPI) >= 0.10.0, <= 0.11.0, ECOSYSTEM:introduced=0.10.0,fixed=0.11.1.
Is there a fix for CVE-2026-87013?
Yes. open-webui (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87013 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-87013?
Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (PyPI): upgrade to 0.11.1 or later
    pip install "open-webui>=0.11.1"

Technical details

The vulnerability is a classic infinite loop triggered by missing cycle detection in a hierarchical data structure. The folder re-parent endpoint (`POST /api/v1/folders/{id}/update/parent`) fails to validate that the target parent is not the folder itself or one of its descendants. The folder model's subtree traversal functions (`DELETE` and `POST /read` endpoints) do not track visited folders, so they infinitely recurse when encountering a cycle. Attack preconditions: authentication required, folders feature enabled (default), user role must have folders permission (default true). An attacker needs only a standard account—no admin or special permissions. The fix in 0.11.1 adds validation to reject self-parenting with a 400 response, implements visited-set tracking in tree walks, and returns looped folders to root on next access. Affected versions: 0.10.0 through 0.11.0 (the subtree walk feature was introduced in 0.10.0).

Affected products

  • open-webui Open WebUI 0.10.0 to 0.11.0

Identifiers

  • CVE-2026-87013
  • GHSA-8r35-5x5r-hv74
  • PYSEC-2026-4121

Timeline

  • 2026-09-04: disclosed: Advisory published by GitHub (initial date)
  • 2026-09-09: patched: Fix released in version 0.11.1
  • 2026-09-10: advisory: GitHub Security Advisory GHSA-8r35-5x5r-hv74 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.