CVE-2026-87012

Executive Summary

CVE-2026-87012 is an input-validation flaw (CWE-754) in Open WebUI, a self-hosted AI platform. From version 0.9.0 until 0.11.1, the calendar event model stored the meta.alert_minutes value without type validation, while the shared upcoming-event scheduler compared that value numerically during an instance-wide alert pass. An authenticated user holding the calendar permission can persist a non-numeric alert_minutes value, causing the scheduler to raise an exception and abort the alert pass, which suppresses reminder notifications for all users whose events fall within the lookahead window. The CVSS v3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting a low-impact availability effect reachable by a low-privileged authenticated user. No public exploit, PoC, or Nuclei template is known, and the vulnerability is not listed in CISA KEV.

Technical Analysis

Open WebUI is an extensible, feature-rich, self-hosted AI platform. Its calendar subsystem allows authenticated users with the appropriate calendar permission to create events that carry metadata, including a reminder field stored as meta.alert_minutes. In affected versions (0.9.0 through 0.11.0), the data-access layer in backend/open_webui/models/calendar.py persisted this metadata value without validating its type. The application therefore accepted arbitrary values for alert_minutes, including strings or other non-numeric JSON types, and stored them as-is.

Reminder delivery is handled not on a per-user basis but by a single shared "upcoming-event scheduler" that iterates scheduled events across the instance during a lookahead window and emits alerts to the relevant users. To decide whether an event is due for an alert, the scheduler compares the stored alert_minutes value numerically. Because the stored value was never constrained to a numeric type at write time, an attacker-influenced non-numeric value reaches this comparison and triggers a type error or comparable exception. Critically, the design of the alert pass means the exception is not isolated to the offending event: it aborts the entire pass. As a result, one poisoned event suppresses reminder processing for every user on the instance for as long as that event remains inside the scheduler's lookahead window.

The root cause is an improper check for unusual or exceptional conditions (CWE-754): the persistence path trusted a client-supplied metadata field's type, and the scheduler assumed a well-formed numeric value without defensive coercion or per-event error handling. The two defects combine — missing validation at ingestion (calendar.py) plus a non-robust numeric comparison in the scheduler — into an instance-wide denial-of-notification condition. The issue is fixed in 0.11.1.

Attack surface and preconditions:

• The vulnerable interface is authenticated and network-reachable (AV:N), exploited via ordinary event creation/update rather than a memory-safety or injection primitive. The attacker does not need elevated privileges beyond the calendar permission (PR:L), and no victim interaction is required (UI:N).
• The scope is unchanged (S:U): the impact stays within the application's own scheduler/notification component.
• No confidentiality or integrity impact is scored (C:N/I:N); the effect is availability of the reminder/alerting function (A:L).

This is not a memory-corruption, command-injection, or remote-code-execution issue, and the description provides no evidence of data theft or persistence beyond the poisoned event itself. Its significance lies in the systemic blast radius: a single low-privileged write degrades a shared function for all tenants/users of the instance, and the failure is silent — reminders simply stop, with no obvious per-user error.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (input-validation / exceptional-condition abuse leading to scheduler abort) and the details given in the NVD description. Only the identifiers present in the source data (meta.alert_minutes, backend/open_webui/models/calendar.py, "upcoming-event scheduler", version range 0.9.0–0.11.1) are referenced.

1. Reconnaissance / target identification. The attacker identifies a reachable Open WebUI instance (version between 0.9.0 and 0.11.0) and obtains any account that carries the calendar permission. Because the platform is self-hosted and often exposed on internal or public web endpoints, discovery can be passive (banner/version fingerprinting) or via an existing low-privilege account. The attacker confirms that calendar event creation is available to their role.

2. Triggering the flaw class. Using the normal calendar event creation/update path, the attacker submits an event whose metadata contains a non-numeric value for alert_minutes (for example, a string or other non-numeric JSON type) instead of an integer. Because backend/open_webui/models/calendar.py stores meta.alert_minutes without type validation, the input is accepted and persisted. The attacker now holds a "poisoned" event whose reminder offset cannot be interpreted numerically.

3. Payload/execution method (vulnerability-class level). The attacker does not run code; the payload is the malformed stored value. On the next cycle of the shared upcoming-event scheduler, the poisoned event is included in the lookahead window and is compared numerically against the alert threshold. The non-numeric value causes the comparison to raise an exception, and that exception aborts the entire instance-wide alert pass rather than being contained to the single event. No special request timing is required beyond keeping the poisoned event within the scheduler's lookahead window.

4. Post-exploitation impact. For as long as the poisoned event stays in the lookahead window, reminder notifications for all users are suppressed — a denial-of-notification condition affecting the instance, not just the attacker's own event. This can be used to silently disable time-sensitive alerts (meetings, deadlines, operational reminders) without deleting data or generating per-user errors. The effect is self-healing only once the poisoned event ages out of the window or is removed; an attacker who can repeatedly create or update such events can sustain the suppression. No evidence indicates follow-on code execution, credential access, or lateral movement from this primitive alone.

Impact Assessment

Business impact centers on the loss of a shared, time-sensitive notification function. Reminder delivery is instance-wide, so a single low-privileged user can degrade alerting for every user of the Open WebUI deployment while the poisoned event remains in the scheduler's lookahead window. Where organizations rely on Open WebUI calendar reminders for operational scheduling, the suppressed alerts can cause missed actions, though the vulnerability does not expose or alter confidential data.

Blast radius and scoring rationale:

• Availability (A:L): the alert pass is aborted, suppressing reminders; the effect is bounded by the lookahead window and does not crash the platform as a whole.
• Confidentiality (C:N) and Integrity (I:N): no data disclosure or stored-data modification beyond the attacker's own event metadata is described.
• Attack Vector (AV:N): reachable over the network through the authenticated calendar interface.
• Attack Complexity (AC:L): no special conditions; a straightforward malformed input satisfies the precondition.
• Privileges Required (PR:L): an authenticated user with the calendar permission suffices.
• User Interaction (UI:N): the suppression occurs through the scheduler, not through victim action.
• Scope (S:U): impact remains within the application's scheduling/notification component.

Affected systems are self-hosted Open WebUI deployments running 0.9.0 through 0.11.0 in which the calendar feature is enabled and users hold the calendar permission. Because exploitation requires only a legitimate low-privilege account, insider risk and "shadow" or shared instances are relevant. The absence of a public PoC, Nuclei template, and KEV listing means mass, opportunistic exploitation is unlikely; the practical threat is targeted suppression of reminders by a user who already has calendar access. Notably, the NVD text and the reported CVSS vector sit at a minor discrepancy (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L mathematically evaluates to 4.3, which matches the stated score); analysts should use the vector as the authoritative descriptor of required conditions.

Detection Guidance

Detection for this issue is inherently behavioral: there is no network signature with fixed byte patterns, so the rules below target abnormal alert_minutes values and telltale scheduler exceptions rather than a specific exploit string. They are starting points and require tuning to each deployment's logging.

Sigma Rule

title: Open WebUI Calendar alert_minutes Type-Validation Abuse (CVE-2026-87012)
id: 7b1c9f42-3a6e-4d21-9f0a-2c8e5b7d6f10
status: experimental
description: Detects creation or update of an Open WebUI calendar event carrying a non-numeric meta.alert_minutes value, and scheduler exceptions that abort the upcoming-event alert pass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87012
author: valtersit.com
date: 2026/01/01
logsource:
  product: open_webui
  service: calendar
detection:
  selection_write:
    event|contains:
      - 'alert_minutes'
    http.method:
      - POST
      - PUT
      - PATCH
  selection_bad_type:
    payload|contains:
      - '"alert_minutes": "'
      - 'alert_minutes: "'
      - '"alert_minutes": null'
      - '"alert_minutes": true'
  selection_scheduler_error:
    message|contains:
      - 'upcoming-event'
      - 'alert_minutes'
    level:
      - ERROR
      - CRITICAL
  condition: (selection_write and selection_bad_type) or selection_scheduler_error
falsepositives:
  - Legitimate clients that send numeric alert_minutes as a string (should be coerced by fixed versions)
level: medium
tags:
  - attack.t1565.001
  - cve.2026.87012

YARA Rule

rule CVE_2026_87012_OpenWebUI_AlertMinutes_Abuse
{
    meta:
        author      = "valtersit.com"
        description = "Detects Open WebUI calendar payloads storing a non-numeric meta.alert_minutes value and related scheduler error strings (CVE-2026-87012)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-87012"
        date        = "2026-01-01"
        cve         = "CVE-2026-87012"

    strings:
        $field = "alert_minutes" ascii wide nocase

        $json_str  = /"alert_minutes"\s*:\s*"/ ascii
        $json_null = /"alert_minutes"\s*:\s*null/ ascii
        $json_bool = /"alert_minutes"\s*:\s*(true|false)/ ascii
        $py_index  = "meta.alert_minutes" ascii
        $sched     = "upcoming-event" ascii nocase
        $valerr    = "TypeError" ascii

    condition:
        filesize < 1MB and
        $field and
        (
            any of ($json_str, $json_null, $json_bool) or
            ($py_index and $sched) or
            ($py_index and $valerr)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87012 Open WebUI calendar alert_minutes non-numeric value"; flow:established,to_server; http.method; content:"POST"; http.method; content:"PUT"; http.method; content:"PATCH"; http.request_body; content:"alert_minutes"; http.request_body; pcre:"/\"alert_minutes\"\s*:\s*(?!\-?\d+\s*[,}])/Ri"; classtype:attempted-dos; reference:cve,2026-87012; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87012; metadata:created_at 2026_01_01; sid:2026870120; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ http where http.request.method in ("POST","PUT","PATCH")
      and url.path : "*calendar*"
      and request.body : "*alert_minutes*"
      and not request.body : /"alert_minutes"\s*:\s*-?\d+/ ]
  [ logs where log.level in ("ERROR","CRITICAL")
      and message : ("upcoming-event" or "alert_minutes")
      and message : ("TypeError" or "exception" or "traceback") ]

Splunk SPL Query

index=open_webui (sourcetype=open_webui:http OR sourcetype=open_webui:app)
```spl
| eval bad_alert = if(match(_raw, "\"alert_minutes\"\s*:\s*") AND NOT match(_raw, "\"alert_minutes\"\s*:\s*-?[0-9]+"), 1, 0)
| eval sched_abort = if(match(_raw, "(?i)(upcoming-event|alert_minutes)") AND match(_raw, "(?i)(TypeError|exception|traceback|aborted)"), 1, 0)
| where bad_alert=1 OR sched_abort=1
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as users by src_ip, uri_path, sourcetype
| sort - count

### Wazuh OSSEC Rule
```xml
<group name="open_webui,cve-2026-87012,">
  <rule id="20268701" level="8">
    <decoded_as>json</decoded_as>
    <field name="meta.alert_minutes">\.</field>
    <description>CVE-2026-87012: Open WebUI calendar event stored non-numeric meta.alert_minutes</description>
  </rule>

  <rule id="20268702" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">alert_minutes</field>
    <field name="message">(?i)(TypeError|exception|traceback)</field>
    <description>CVE-2026-87012: Open WebUI upcoming-event scheduler aborted by malformed alert_minutes</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, affected-version list, or OSV package data was corroborated. Treat the 0.11.1 reference below as vendor-stated only; verify independently before relying on it.

1. Immediate mitigations

   • Restrict the calendar permission to the minimum set of trusted users until the validation and scheduler-resilience issues can be addressed. This removes the low-privileged write primitive central to the CVSS PR:L rating.
   • Audit existing calendar events for meta.alert_minutes values that are non-numeric, null, boolean, or otherwise malformed, and remove or correct them. Clearing poisoned events restores reminder delivery once the scheduler's next pass succeeds.
   • Where feasible, place the Open WebUI instance behind authentication and network controls so only known users can reach the calendar API; the vulnerability is authenticated and does not require victim interaction.
   • Monitor application logs for scheduler exceptions referencing the upcoming-event alert pass and alert_minutes, which indicate an active or lingering poisoned event.

2. Patch / upgrade steps

   • Per the NVD description, this issue is fixed in Open WebUI 0.11.1 (introduced-in is 0.9.0). If that release is available from an authoritative source, upgrade instances running 0.9.0–0.11.0 to 0.11.1 or later.
   • Because patch confidence is 0/4, validate the fix: confirm the release changes backend/open_webui/models/calendar.py to enforce a numeric type on meta.alert_minutes and makes the shared scheduler tolerant of malformed values (e.g., coercion or per-event error isolation). Re-test by storing a non-numeric alert_minutes and confirming other users' reminders still fire.
   • If no fixed release can be validated, apply an application-layer input restriction (reject non-integer alert_minutes) at a reverse proxy or API gateway, and/or backfill validation in the model layer.

3. Long-term hardening

   • Enforce strict schema/type validation on all client-supplied metadata at the persistence boundary (calendar.py), rather than trusting callers.
   • Make shared/scheduled background jobs fault-isolated: a single malformed record should never abort a pass that serves all users; wrap per-item processing so one error is logged and skipped rather than propagated.
   • Add regression tests covering malformed alert_minutes types and scheduler exception paths to prevent reintroduction.
   • Apply least-privilege for the calendar permission and alert on permission grants, since a single calendar-capable account is sufficient to trigger this class of abuse.
   • Track the Open WebUI project's advisories and maintain an inventory of self-hosted instances by version so future fixes can be applied promptly.

References

• NVD — CVE-2026-87012: https://nvd.nist.gov/vuln/detail/CVE-2026-87012
• CWE-754 — Improper Check for Unusual or Exceptional Conditions: https://cwe.mitre.org/data/definitions/754.html
• Open WebUI project (vendor/source repository — verify the repository and the 0.11.1 fix directly): https://github.com/open-webui/open-webui
• FIRST EPSS: Not yet scored by FIRST.org for this CVE — no EPSS value is asserted here.
• CISA KEV Catalog: CVE-2026-87012 is NOT listed in CISA KEV at time of writing.

Threat-actor and exploit-in-the-wild notes: No public PoC, no Nuclei template, and no exploit code were identified for CVE-2026-87012; there is no known exploit-in-the-wild activity or associated threat-actor campaign. The absence of a public exploit and the authenticated, low-impact nature of the flaw (CVSS 4.3, availability-only) make opportunistic, mass exploitation unlikely. The more realistic risk is targeted suppression of reminder notifications by a user who already holds the calendar permission — for example, a malicious or negligent insider on a self-hosted deployment. Analysts should continue to monitor for a published advisory and any PoC emergence, and should treat the "fixed in 0.11.1" statement as unverified until confirmed against the vendor's release artifacts.