CVE-2026-87013: Open WebUI Folder Parent Cycle Vulnerability Leading to Non-Terminating Requests
Summary
CVE-2026-87013: Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle. Affects open-webui versions >= 0.10.0, < 0.11.1. Fixed in 0.11.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is an open-source web application that allows users to manage folders and files efficiently. It provides features such as folder creation, re-parenting, and hierarchical organization of data. However, it has a vulnerability that allows authenticated users to create a folder loop, leading to performance degradation and resource exhaustion.
Vulnerability Detail
The vulnerability arises from the lack of validation in the folder re-parenting functionality. Authenticated users can move a folder under itself, creating a loop in the folder hierarchy. This results in non-terminating requests that consume CPU resources and memory, as the system continuously processes the loop without completing the request. The issue is exacerbated by the fact that the folder tree walks do not track previously visited folders, leading to indefinite processing. The impact includes potential denial of service for the application, as the requests hold CPU cores and grow memory usage significantly over time.
How To Fix
Latest published version: 0.12.3 as of 22 Oct 2026
pip install --upgrade "open-webui==0.12.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.11.1
This is the first release that contains the fix.
pip install --upgrade "open-webui==0.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the folder feature by setting ENABLE_FOLDERS to false in your configuration. This will prevent any folder-related operations until the package is updated.
Conclusion
The CVE-2026-87013 vulnerability in Open WebUI poses a significant risk by allowing authenticated users to create folder loops, leading to non-terminating requests and resource exhaustion. It is crucial to update to version 0.11.1 or later to mitigate this issue and ensure the application's stability.
See every vulnerability recorded for open-webui →
FAQ
The vulnerability allows authenticated users to create a folder loop, leading to non-terminating requests that consume system resources.
Any authenticated user with folder permissions can exploit this vulnerability if folders are enabled in the application.
The primary impact is resource exhaustion, which can lead to performance degradation and denial of service for other users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
