THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-2f54-p244-32q6 (medium) — Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

[GHSA] GHSA-2f54-p244-32q6 (medium) — Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

medgithub_advisoriesPublished 2026-08-04

GHSA-2f54-p244-32q6 Severity: medium CVE: CVE-2026-70493

Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

## Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking `re` engine and run ag

Indicators of compromise

CVE-2026-70493cve

Original source: https://github.com/advisories/GHSA-2f54-p244-32q6