{"metadata": {"vulnerability": "CVE-2026-87011", "count": 17, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-08T16:44:23.783Z", "date_only": false, "value": "2026-09-08T16:44:23.783Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-87011", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-09T20:54:26.207Z", "date_only": false, "value": "2026-09-09T20:54:26.207Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87011", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-09T20:54:26.207Z", "date_only": false, "value": "2026-09-09T20:54:26.207Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-87011", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-09T21:17:05Z", "date_only": false, "value": "2026-09-09T21:17:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3G9Q-V48F-HH9W", "record": "GHSA-3G9Q-V48F-HH9W", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-09T21:17:05.847Z", "date_only": false, "value": "2026-09-09T21:17:05.847", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87011", "record": "FKIE_CVE-2026-87011", "field": "published"}, {"timestamp": "2026-09-09T21:59:59.213Z", "date_only": false, "value": "2026-09-09T21:59:59.213980Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4jwh7atj2z", "record": "CVE-2026-87011", "field": "creation_timestamp", "uuid": "c9c26333-2408-48b5-bdf6-fc9e47460744", "content": "\ud83d\udfe0 CVE-2026-87011 - High (7.5)\n\nOpen WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-87011/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4jwh7atj2z"}, {"timestamp": "2026-09-10T22:44:42Z", "date_only": false, "value": "2026-09-10T22:44:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3G9Q-V48F-HH9W", "record": "GHSA-3G9Q-V48F-HH9W", "field": "published"}, {"timestamp": "2026-09-10T22:44:42Z", "date_only": false, "value": "2026-09-10T22:44:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3G9Q-V48F-HH9W", "record": "GHSA-3G9Q-V48F-HH9W", "field": "modified"}, {"timestamp": "2026-09-11T00:35:33.569Z", "date_only": false, "value": "2026-09-11T00:35:33.569332Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w", "record": "CVE-2026-87011", "field": "creation_timestamp", "uuid": "8cfc2dff-4bf2-4b48-ba80-f974f93df0d2", "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w"}, {"timestamp": "2026-09-11T13:31:48.013Z", "date_only": false, "value": "2026-09-11T13:31:48.013055Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/d61ce1f74a389eb9b11e0ada4e2c5671", "record": "CVE-2026-87011", "field": "creation_timestamp", "uuid": "2abc5c47-aba9-451b-8325-62cc98f89882", "content": "# CVE-2026-87011: CVE-2026-87011: Denial of Service via Event-Loop Starvation in Open WebUI OIDC Back-Channel Logout\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-87011\n\n## Summary\nCVE-2026-87011 is a critical vulnerability in Open WebUI versions 0.9.0 through 0.11.0. It allows unauthenticated remote attackers to trigger a Denial of Service (DoS) by sending crafted tokens to the back-channel logout endpoint, causing synchronous network calls that block the single-worker ASGI event loop.\n\n## TL;DR\nUnauthenticated remote attackers can freeze Open WebUI instances by exploiting a synchronous blocking network call in the OIDC back-channel logout handler.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-405, CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00339 (0.34%)\n- **Exploit Status**: PoC mapped\n- **CISA KEV Status**: Not Listed\n- **Remediation**: Upgrade to v0.11.1 or disable back-channel logout\n\n## Affected Systems\n\n- Open WebUI\n- **Open WebUI**: >= 0.9.0, < 0.11.1 (Fixed in: `0.11.1`)\n\n## Mitigation\n\n- Upgrade Open WebUI to version 0.11.1 or higher\n- Set ENABLE_OAUTH_BACKCHANNEL_LOGOUT=false in environment configurations\n- Implement strict rate limiting on /oauth/backchannel-logout via reverse proxies\n\n**Remediation Steps:**\n1. Verify current Open WebUI version is between 0.9.0 and 0.11.0\n2. Deploy updated Docker image ghcr.io/open-webui/open-webui:v0.11.1\n3. If unable to upgrade immediately, set the environment variable ENABLE_OAUTH_BACKCHANNEL_LOGOUT to false\n4. Verify back-channel logout endpoint responds with 404 or is disabled after configuration change\n\n## References\n\n- [Official Fix Commit](https://github.com/open-webui/open-webui/commit/aeda6ff13a25d3b3ba1b303609f35382db22142c)\n- [GitHub Security Advisory GHSA-3g9q-v48f-hh9w](https://github.com/open-webui/open-webui/security/advisories/GHSA-3g9q-v48f-hh9w)\n- [Open WebUI v0.11.1 Release Notes](https://github.com/open-webui/open-webui/releases/tag/v0.11.1)\n- [NVD Entry for CVE-2026-87011](https://nvd.nist.gov/vuln/detail/CVE-2026-87011)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-87011) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/d61ce1f74a389eb9b11e0ada4e2c5671"}, {"timestamp": "2026-09-14T13:41:36.439Z", "date_only": false, "value": "2026-09-14T13:41:36.439676Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-87011", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-14T13:41:36.439Z", "date_only": false, "value": "2026-09-14T13:41:36.439676Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87011", "record": "FKIE_CVE-2026-87011", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-14T13:42:35.435Z", "date_only": false, "value": "2026-09-14T13:42:35.435Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-87011", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-14T13:42:35.435Z", "date_only": false, "value": "2026-09-14T13:42:35.435Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-87011", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T16:26:18.880Z", "date_only": false, "value": "2026-09-15T16:26:18.880", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87011", "record": "FKIE_CVE-2026-87011", "field": "lastModified"}, {"timestamp": "2026-10-01T16:38:30.355Z", "date_only": false, "value": "2026-10-01T16:38:30.355680Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4117", "record": "PYSEC-2026-4117", "field": "published"}, {"timestamp": "2026-10-01T17:10:34.305Z", "date_only": false, "value": "2026-10-01T17:10:34.305219Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4117", "record": "PYSEC-2026-4117", "field": "modified"}]}