Open WebUI is the ChatGPT-style front end most people put in front of Ollama. It runs as one Docker container or a pip package, connects to Ollama and to any OpenAI-compatible API at once, and adds what the bare API lacks: accounts and roles, chat history and search, document upload with retrieval, web search, image generation, voice, and a function and pipeline system for extending it in Python.
The project moves at a pace few open-source apps match, with releases most weeks and a Python-plus-Svelte code base that is now the size of a small company's product. The licence is its own: BSD-3-Clause with an added clause that keeps the Open WebUI branding in place for deployments over fifty users. For a personal or team install that changes nothing; for a rebranded product it is a conversation with the maintainers.
- Repository: github.com/open-webui/open-webui
- Licence: custom (Other)
- Language: Python. Stars: 152.3K. Forks: 22.3K. Last push: Sep 16, 2026.
- Scan: clean, read the notes, Sep 4, 2026, commit 0a7c158
Who it is for
Households and teams that want one private chat interface for everyone, with their own documents searchable in it, and administrators who need per-user access to a mix of local and paid models without handing out API keys.
Getting started
1. Run with Docker, talking to Ollama on the same machine
docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main2. Or install with pip (Python 3.11)
pip install open-webui && open-webui serve3. Then open the interface and create the first account, which becomes the admin
open http://localhost:3000Safety scan
We cloned open-webui/open-webui at commit 0a7c158 on Sep 4, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no self-decoding code, no bare-IP URLs across half a million lines of Python and Svelte.
- One pattern hit: the Dockerfile's :ollama image variant installs Ollama with its official curl | sh script at build time. That runs on the build server, not on your machine.
- The known advisories are the note. backend/requirements.txt pins chromadb 1.5.9, nltk 3.9.4 and unstructured 0.22.31, each with critical advisories (code injection, unsafe pickle loading, server-side request forgery). These are runtime dependencies in the Docker image, reachable through document ingestion and the default vector store. The project releases most weeks and bumps pins often, so check the current requirements file, keep the instance behind authentication, and do not expose it to the internet unpatched.
- The npm lockfile's critical entries are Vitest, a test runner, which never ships.
- Seven workflows, none using pull_request_target; the 15 third-party actions are pinned to tags. Dependabot is configured, and there is a security policy and a code of conduct.
- Licence: BSD-3-Clause plus a clause that keeps the Open WebUI branding in place for deployments over fifty users in a month. Personal and team installs are unaffected.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | 1 installer script |
| Committed binaries | None. |
| CI workflows | 7 workflows. None use pull_request_target. 15 of 15 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often docs.openwebui.com, github.com, openwebui.com, api.openai.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 205 advisories across 1,595 pinned packages: 9 critical, 99 high, 85 moderate, 11 low, 1 unrated. backend/requirements-min.txt: 37 packages, 21 advisories; backend/requirements.txt: 125 packages, 105 advisories; package-lock.json: 1,274 packages, 67 advisories; uv.lock: 350 packages, 138 advisories. |
| Project hygiene | Has security policy, automated dependency updates, licence file. Missing CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| Dockerfile:177 | download-piped-to-shell | curl -fsSL https://ollama.com/install.sh | sh && \ |
Installer scripts (1)
- backend/start.sh, 114 lines
Worst known vulnerabilities (24 of 205)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-36p7-vc44-83pf | critical | chromadb@1.5.9 | ChromaDB has a code injection vulnerability |
| GHSA-f4j7-r4q5-qw2c | critical | chromadb@1.5.9 | ChromaDB Python project has a pre-authentication code injection vulnerability |
| GHSA-4mvj-m6j5-pmf7 | critical | unstructured@0.22.31 | unstructured: Server-Side Request Forgery in the URL-based partitioning |
| GHSA-m4rf-3fr8-xwx3 | critical | nltk@3.9.4 | NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841… |
| GHSA-rhp5-r9x4-f5g2 | critical | nltk@3.9.4 | NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution |
| GHSA-x99w-6fgc-pmfw | critical | nltk@3.9.4 | NLTK: Allowlisted pickle loaders still permit code execution in current source |
| GHSA-5xrq-8626-4rwp | critical | vitest@1.6.1 | When Vitest UI server is listening, arbitrary file can be read and executed |
| GHSA-284h-m62q-gf8w | critical | gitpython@3.1.50 | GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any… |
| GHSA-pv9p-5w55-55jm | critical | mariadb@1.1.14 | |
| GHSA-cq5v-8q36-5273 | high | aiohttp@3.13.5 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| GHSA-ffg3-p8fm-mjx2 | high | restrictedpython@8.2 | RestrictedPython guard hooks can be shadowed via positional-only arguments |
| GHSA-vj7q-gjh5-988w | high | mcp@1.27.2 | MCP Python SDK: WebSocket server transport does not support Host/Origin validation |
| GHSA-2wm9-hf6c-p5cr | high | chromadb@1.5.9 | ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection |
| GHSA-xph7-9rjv-w5fr | high | chromadb@1.5.9 | ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to |
| GHSA-537c-gmf6-5ccf | high | cryptography@48.0.0 | Vulnerable OpenSSL included in cryptography wheels |
| GHSA-g6cj-pr64-35w5 | high | cryptography@48.0.0 | cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing |
| GHSA-jwv3-5hgf-82ww | high | cryptography@48.0.0 | python-cryptography: Duplicate self-signed intermediates can cause exponential path-building |
| GHSA-xrqw-3rrv-vx5w | high | transformers@5.5.4 | Transformers save_pretrained path traversal allows arbitrary file writes through chat template names |
| GHSA-rgxp-2hwp-jwgg | high | pyarrow@20.0.0 | Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering |
| GHSA-5xf7-4p34-54qr | high | pypdf@6.7.5 | pypdf: Possible infinite loop for not terminated inline images |
| GHSA-g867-7843-wf8q | high | pypdf@6.7.5 | pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) |
| GHSA-gm37-52c6-37mw | high | pymdown-extensions@10.21.3 | pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors |
| GHSA-3gq4-3j92-5w49 | high | nltk@3.9.4 | NLTK: Corpus Reader Sandbox Bypass |
| GHSA-568f-pv23-39p4 | high | nltk@3.9.4 | NLTK: Stable FrameNet and NKJP readers parse outside-root XML |
By the numbers
| Stars | 152.3K |
|---|---|
| Forks | 22.3K |
| Contributors | 874 |
| Commits | 18.4K |
| Open issues | 240 |
| Open pull requests | 65 |
| Releases | 170 |
| Latest release | v0.11.3 |
| Licence | custom |
| Main language | Python |
| Project age | 2 years |
| Last push | Sep 16, 2026 |
| Tracked files | 5,061 |
| Lines of code | 504.3K |
| Checkout size | 105 MB |
Lines by language: JSON 211.2K, Svelte 130.8K, Python 114.2K, TypeScript 26.3K, CSS 11.7K, Markdown 6,424.
Questions
Is Open WebUI really open source?
The code is public and free to use, modify and self-host. Since version 0.6.6 the licence is a BSD-3-Clause variant with one extra condition: deployments with more than fifty users in a month may not remove or alter the Open WebUI branding without permission or an enterprise licence. Strict open-source definitions would call that source-available; for most users the difference is academic.
Does Open WebUI need Ollama?
No. Ollama is the default local back end, but Open WebUI connects to any OpenAI-compatible endpoint, so it works with llama.cpp's server, LM Studio, vLLM, and paid APIs from OpenAI, Anthropic through a proxy, Groq and others, all at the same time.
Can Open WebUI search my documents?
Yes. Uploaded files are chunked, embedded and stored in a local vector database, and you can reference a document or a whole collection in a chat with a hash. Web search and web page fetching are separate features, off by default, that need a search provider configured.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.