0.11.1 - #1356
Open
Classic298 wants to merge 122 commits into
Open
Conversation
Orchestrator-backed terminals can now be scoped per context: shared, scoped to a single chat, or switched off in chats entirely. An API caller that picks a terminal without checking gets a 503 it has no way to interpret, and the server-side tool calling page previously said terminal_id was unconditional. The page now explains the three states, reads the contexts field in the discovery snippet, and records the two new 503 causes with their fixes. It also notes that a chat-scoped terminal cannot be used from the single-request path, which never creates a chat to scope to. This describes behaviour on dev that is not in any release yet. Connections that are not orchestrator-backed carry no contexts entry and behave exactly as every released version does, which the page states explicitly.
Covers the settings and behaviour changes that administrators and operators need to know about before upgrading, written against the code rather than the changelog. ENABLE_ORJSON now reaches the database JSON columns, outbound Ollama and Anthropic request bodies, built-in tool results, the permission lookup and Valkey and Oracle 23ai chunk metadata, so the reference entry, the scaling guide and both performance pages describe what the flag actually covers today. Non-ASCII is written raw rather than escaped, and both encoders read each other's output, so switching it on or off needs no migration. TASK_MODEL_PARAMS gives administrators the generation parameters used for titles, tags, follow-ups, search queries and conversation summaries, replacing the fixed token limit that could cut a summary short. ENABLE_RAG_CSV_SUMMARY prefixes CSV content with its row count, data row count and column names so the model sees the shape of the table alongside its contents. DEFAULT_INTERFACE_SETTINGS sets system-wide defaults for the interface options in Settings, with each person's own choices still taking precedence, alongside the new setting for switching off sidebar chat previews. AIOHTTP_CLIENT_ASYNC_DNS_RESOLVER returns to system name resolution by default, which removes the intermittent lookup failures that surfaced as a misleading model not found message, and WEBSOCKET_EVENT_CALLER_TIMEOUT now reports a timeout for an unanswered tool prompt instead of an empty reply. Single sign-on settings supplied through the environment are shown as read-only in the admin panel with the setting that controls them named, and sign-in through providers that add vendor-specific claims to the token completes instead of failing as a bad email or password. OpenSERP can be selected as the web search engine from the admin panel, and a link that cannot be read now names the link while a refused YouTube transcript explains why and points at the proxy setting.
Adds a Terminal Contexts page under orchestration covering the per-context availability and workspace scoping an administrator sets for chats and for automations separately, the Shared, Per chat, Per automation and Off options, the fact that both rows default to Shared, and the orchestrator version needed before per-context workspaces do anything rather than silently behaving as shared. Direct Open Terminal connections have no contexts and always resolve to the same workspace. Records the failure responses of the web content endpoint so a caller can tell the three cases apart: a link that could not be fetched or parsed names the URL it was given, a YouTube URL reports why its transcript was refused, and only a genuine storage failure mentions the knowledge base. The retrieval page now points at the same troubleshooting entry instead of implying the attempt silently produces nothing. Corrects the CSV summary notes to say which extraction engines never reach the built-in parser, and states plainly that the Default label in Settings and Interface appears on switches only while every other inherited option tracks the instance default in the same way without a label. Notes that an interactive event call returns a dict carrying an error key when the browser cannot answer, either because the tab disconnected or because the configured caller timeout elapsed, so a plugin checks for that key before using the result.
…d CSV retrieval behaviour Carries the per-context terminal settings into the pages an administrator actually reads: connecting a terminal, the terminals overview, the file browser, multi-user setup and the Docker deployment tab now describe when a terminal is offered in chats and in automations, and whether a workspace is shared or created per chat or per automation. Temporary chats and channel chats have no stored chat record, so a terminal scoped per chat is unavailable there, and the URL parameter and automation pages say so. Records what reindexing a knowledge base now does: the knowledge base collection and the per-file collections are both deleted and rebuilt from the stored text, so attaching a single file afterwards finds its content again. Reindexing never parses the original file a second time, and a file with no stored content is reported instead of being indexed empty. The Milvus and Qdrant multitenancy notes are corrected to say which vectors a reindex migrates. Adds the CSV table summary to the retrieval guide and the environment reference, with the exact line it prepends, how the row count, data row count and column names are derived, and which extraction engines never reach the built-in parser and so never produce it. Documents why attaching a link or a YouTube video can fail, with the message each cause produces, and records the failure responses of the web content endpoint so a caller can tell a failed fetch from a failed save.
…t search behaviour Chat search now matches every word of a query in any order, drawing words from the title or from any message, and lists exact phrase matches first. On default SQLite installations the search only ever read an older storage location, so the messages of ongoing conversations were invisible to it, and the archived chats guidance to restore a chat before searching its content is removed because it no longer applies. Records that removing someone's memory permission stops their stored memories reaching the model, and that memories are now handed over in a fixed order with entries sorted alphabetically, which is what lets a provider reuse its work between turns instead of reprocessing the conversation on every reply. A task handed to a sub-agent can carry the attachments it needs, so an image or document from the conversation reaches the sub-agent rather than arriving as a reference it cannot open. Conversations started by automations, timers, sub-agents and channels report their token usage like any other chat. Files and folders in the terminal file browser that cannot be changed are labelled read-only, with uploading, editing, renaming, moving and deleting unavailable rather than failing at the moment they are attempted.
…coming release Sending a message before its attachments have finished uploading now queues it and sends it once they are ready, and each queued message shows the progress of its own attachments, so the send no longer fails outright. A note whose content was stored as structured data rather than text no longer breaks the notes page, and opens with that content shown as a formatted code block. Records that attaching a conversation shared with you, directly or through a shared folder, brings its content along, and the permission notes now say which capabilities are checked when a chat is filed into a folder.
…orting A task handed to a sub-agent can now carry specific attachments from the parent conversation, chosen by file id. A sub-agent that is given none starts with no attachments at all, where it previously inherited everything attached to the parent chat, and an id that is not attached to the parent fails the call before any sub-agent runs. Images handed over this way reach a vision model as images rather than as a reference it cannot open. Revoking the memories permission now stops stored memories reaching the model in every path, including the system context injection that had continued regardless, and the permission is rechecked on the server rather than trusted from the request. Memories are rendered in a fixed section order with entries sorted alphabetically, so an unchanged selection produces an identical block from one message to the next and a provider can reuse its cached prefix instead of reprocessing the conversation on every reply. The character budget is applied after that sort, so it drops whatever sorts last rather than whatever is oldest, and the caching notes are corrected to match. Chats started by automations, timers, sub-agents and channels report token usage like any other chat, because the request for it is made on the server for every caller when the model has the usage capability enabled. Non-streaming requests are unaffected.
…notes to observable behaviour The user table's single OAuth subject column was replaced by a JSON field keyed by provider in v0.6.41, so one account can hold subjects from several identity providers at once. Databases still older than that when they were upgraded on a v0.9.6 or newer build had the value written as text rather than as an object, which locked the affected accounts out of signing in; a migration rewrites those rows on startup and leaves every other row alone. The SCIM linking notes are corrected to match the field that actually exists. The faster JSON encoder notes now describe what an operator can observe, saving and opening chats, signing in, knowledge base searches and the requests sent out to model providers, rather than the internals behind each. The Valkey and Oracle 23ai vector store sections say plainly that stored chunk details are written on upload and read back on every search, which is the work the setting speeds up.
…the sharing permission defaults System-wide defaults for the interface options now have a page of their own under Administration, alongside Banners and Webhooks, with the full list of options an administrator can set, what each one does and the value it falls back to when nothing is configured. A person's own choice always wins, anything they have never touched keeps following the instance default and moves with it when that default changes. The getting-started settings page keeps a short pointer to it. Public sharing of tools and notes is documented as switched off by default, which is what the code actually does. Instances upgraded from older versions could show both as enabled in the admin panel while the server denied them, and saving any unrelated permission wrote that phantom value in for real, so the sharing notes now say to re-check those two toggles after an upgrade. The documented defaults and types of the affected permission variables are corrected to match the code.
Name lookups go through the operating system again by default, which removes the intermittent failures that surfaced as a misleading model not found message. The faster c-ares resolver stays available and is worth trying, since it takes a delay out of the front of every outbound request, with the Windows and Docker failure modes named so nobody switches it on blind and the reason its dependency is pinned spelled out for anyone building a custom image. An interactive event call that goes unanswered now returns an error value rather than raising, so the plugin pages no longer tell authors to wrap the call in a try block for a timeout that never raises, and the exact value a plugin receives is written down. Waiting too long no longer drops a tab that is still open.
…ngle sign-on settings Sending a message before its attachments have finished uploading now queues it and sends it once they are ready, with each queued message showing the progress of its own attachments and the send button held until they settle. A failed upload holds the queue until that entry is edited or removed, and the behaviour applies whether or not the message queue setting is enabled. Any conversation you can read can be attached to a chat of your own as context, whether it was shared with you by name, through a group, set to public or sits in a folder shared with you. Referencing a chat had no documentation at all, so it is written up alongside: what the picker offers, that dragging works for chats that are not yours, and that the live conversation is used rather than the snapshot behind a share link. Single sign-on settings supplied through the environment are now shown as read-only in the admin panel with the variable that controls them named, instead of accepting edits that were discarded on the next restart. Sign-in through a provider that adds parameters of its own to the token header completes rather than failing with a message claiming the email or password was wrong. Corrects stale admin panel paths on every page touched here. The settings sidebar groups tabs under headings, and those headings are not part of the path.
Says plainly that the CSV table summary is off by default and that a restart is needed after turning it on, since it is read from the environment and has no admin panel control. What remains on the page is the summary line itself, that the column count follows the widest row, that the delimiter is detected so semicolon separated files work, that the line is always present under Using Entire Document, which extraction engines produce no summary at all and that files parsed before the setting was turned on need re-uploading. The reindex notes end on the outcome rather than the bookkeeping: after rebuilding, attaching one file from a knowledge base to a chat on its own retrieves the same content as searching the knowledge base it belongs to.
The settings sidebar groups its tabs under headings, and those headings are not part of the path a reader clicks. Paths written as Settings > Admin > AI > Models, Settings > Admin > System > General or Settings > Admin > Tools > Web Search name a level that does not exist, so they are now written as Settings > Admin followed by the actual tab. Two of them named the wrong destination as well. External tool servers are configured under Integrations rather than under a Tools tab, and the tab for running code is called Code Execution rather than Code Interpreter.
…he admin path sweep The system-wide defaults for the interface options now have a page of their own under Administration, alongside Banners and Webhooks, carrying the complete list of options an administrator can set with the label each one has in the interface and the value it falls back to when nothing is configured. A person's own choice always wins, anything they have never touched keeps following the instance default and moves with it when that default changes, and an option nobody has touched is marked as such next to its switch. The page also covers locking the interface page entirely through the settings permission, and the fact that the environment variable reaches settings that the admin panel does not expose. The independently maintained Interface Defaults plugin listed under the ecosystem pages is noted as largely covered by the built-in feature now, with the behavioural difference stated so a reader can choose between them. Completes the admin panel path correction for the pages that write their paths with arrows rather than angle brackets.
…terminal browser Changing someone's role now ends their live sessions however the change was made, from the admin panel, a directory sync, an identity provider or a trusted header, so permissions from the old role cannot linger, and the browser reconnects on its own. Deleting an account behaves the same way, and the behaviour holds across replicas. Accounts on instances coming from a version older than 0.6.41 could be locked out of signing in entirely, because an upgrade step wrote their single sign-on identity in a form the application could not read back. A repair runs on startup and needs no manual work, and the troubleshooting entry names the exact symptom, the log line and the affected population so an administrator can recognise it. The user table reference is corrected to the field that actually exists. Task model configuration now has a page of its own under Administration: which model runs background work, the parameters those requests use and the per task switches. Setting any parameter replaces the built in output limit entirely, so a limit has to be set explicitly or there is none. Merging several models' answers uses one of the models being compared and never the task model, so the multi-model page no longer tells readers to configure a task model for it. Files and folders in the terminal file browser that cannot be changed are marked read-only, with creating, uploading, renaming, moving, editing and deleting unavailable rather than failing when attempted.
The environment variable reference and the database schema reference both announced which release they were current with, and both still named the previous one. Every other mention of that version is a factual statement about when something shipped or changed, so those are left alone.
… previews Typing the model command on its own reports which model the conversation is using, following it with a model id switches to that model, and choosing it from the slash menu opens the model picker with its search box focused. The four built-in command names are effectively reserved, so a saved prompt sharing one of those names is intercepted when a user types it out and sends it, which the prompts page now says. A writing block produced by a model is titled with its subject and shows the recipient beside it when the model supplies them, instead of every block reading the same way. Word documents open as pages with their headers, footers, footnotes and embedded images intact and can be zoomed, falling back to simpler rendering when a file cannot be laid out. Presentations open in a viewer with a thumbnail strip, zoom and panning. The slide preview is an approximation, so the file should be downloaded and opened in its own application when the exact rendering matters.
When configuration persistence is switched off globally, that setting is the one in charge, so turning on the single sign-on specific persistence makes the section editable again without making the edits last. Both have to be on to manage single sign-on from the admin panel, and the pages now say so rather than leaving an administrator to work it out from the symptom. The list of selectable web search engines was missing three of the engines the interface offers, so all three are added with the variables each one needs.
… without quoting it The task model parameters panel shows several controls that have no effect on background requests, so both the reference entry and the task models page name them outright rather than leaving an administrator to set them and wonder why nothing changed. The CSV table summary is described by what it contains, the total row count, the data row count and the column names taken from the header, instead of reproducing the line verbatim in two places where it would go stale the moment the wording changes. Chat search now says how a query is matched: every word has to appear, in any order, drawn from the title or from any message, with exact phrase matches listed first and the rest by how recently they were updated. The filter prefixes are corrected to the forms that actually do something, since a prefix written without a value is discarded and filters nothing.
Messages the configured log level discards are no longer assembled at all, so the log level is now a processing cost lever rather than only a verbosity control. The logging guide says which messages each level skips, including the retrieval results written once per knowledge base request that only a level above the default drops, and the performance guide carries it alongside the other tuning options with the trade-off spelled out: raising the level to reduce work also removes the informational lines a log aggregator is usually set up to collect. The character budget for context memories is described as a plain cut off, since the previous wording promised that older or lower priority entries are the ones dropped, which is not what happens.
…in paths The capabilities table on the models page was missing five of the toggles the model editor actually offers, so all five are documented with the default each one carries. Usage is the only capability that is off unless someone turns it on, and it is what makes a model report its token counts, so the analytics page and the chat completions reference now say where those figures come from and that scheduled and delegated runs land in the same totals. Automations, timers and channels each carry a line saying their runs report token usage like any other chat, so a reader on one of those pages does not have to find the central explanation to learn it. A task handed to a sub-agent starts with no attachments unless it is given specific files, where it previously inherited everything attached to the parent conversation, and asking for a file that is not attached fails the call before any sub-agent runs. The remaining sidebar grouping labels are removed from admin panel paths, so every path now names a tab that exists.
…equests The orchestration section now uses whole sidebar positions with no ties, where two pages previously shared one and fell back to alphabetical order, and the section's own reading list is reordered to agree with the sidebar. Terminal traffic authenticates as the person using it when the connection is set to session authentication, while the policy, lifecycle, status and refresh requests take the orchestrator's admin key and never a user token. That split is how the two products divide the work, so the admin key stays configured even when user authentication is in use. The documented refresh and stop request bodies carry the context field, with the accepted values and the difference between them: omitting it on a refresh matches every context, while omitting it on a stop targets the shared terminal only, so terminals scoped to a chat or an automation survive.
…nformant providers openGauss works as a vector store now, where previously a deployment configured for it failed the moment it touched the store, so it is documented for the first time: added to the list of selectable vector databases, with its own section covering the connection URL, the vector length used when the store is created and the connection pooling settings, alongside the same non-core notice its neighbours carry. Connections using the Responses format now survive two ways a provider can deviate from it. A provider that closes a stream reporting no content no longer wipes the reply that was already streamed, and fragments arriving before the part they belong to are skipped instead of cutting the answer short. For anyone calling the API directly, that second case also meant the response body ended without its terminator and the filters that run when a message finishes never ran. The filter guidance is corrected to match, since an edit made only at the closing event never reaches the saved message when a provider closes with nothing in it.
…ls in line with the interface Paths written as Admin Settings followed by a tab are the same destination as Settings then Admin then that tab, so they are written the one way throughout. Paths to the admin panel's own top-level pages are a different destination and are left as they are. The sharing permission table now uses the labels the admin panel actually shows, so a reader can match a row to the switch in front of them. The claim that the group sharing default does not persist is removed, verified against the code as no longer true. Records that a knowledge base search no longer holds up the worker that issued it, so a slow vector store costs the chat that searched rather than everyone connected to that worker, and that the timeout setting stops a request being held open rather than stopping the whole application from stalling. A message sent while the shared model list is being rebuilt no longer fails or runs against a mix of old and new entries. That applies to chats using a person's own direct connections on a Redis-backed deployment, which is where the model list is shared between replicas.
A provider whose reply only takes its final shape at the very end no longer leaves the finished answer out of the conversation, so the model can see its own previous reply on the next turn. An unusually large piece of a response now passes through in full rather than breaking the response, which was possible on default settings because the safeguard only applied when a size limit had been configured. The reference entry says which values disable the limit and what the trade-off is when nothing is set.
…yter output Anyone running the released 0.11.0 with the faster JSON encoder switched on can lose pieces of a streamed reply when the model's output contains one of three rarely used line separator characters, because those were passed through raw and split the response where it was read. The troubleshooting entry names the trigger, says upgrading fixes it and gives switching the encoder back off as the interim workaround, and it is reachable from the existing symptom list for text going missing from responses. Output coming back from a Jupyter server for code run in chat is handled by the same encoder, so printed output and generated charts appear faster with it enabled, which is now recorded where the engine is configured and in the coverage breakdown.
…r tool authorization Two reference pages stated the opposite of what the code does: they said outlet filters are skipped for callers that omit the chat and message identifiers, and that they only run on non-streaming requests. Outlet filters run for direct API callers by default on both the streaming and non-streaming paths, and those identifiers decide where the response goes rather than whether filters run. Both pages are corrected, and the claim that a filtered payload comes back in the response body is unchanged because it was already right. Authorizing a tool server's external account now completes only for the person who started it and only in the browser session that started it, and signing out cancels an authorization still in progress. The three ways it can be refused are listed with the message each one produces. The Windows start script generates the secret key it needs on a fresh installation and copes with an installation path containing spaces. The key generation reference now covers all three ways a key is created, including the Windows one, rather than describing only the others. The permission tables now use the labels the admin panel shows, across every section rather than only sharing, with the cross-references between rows updated to match.
The chat permissions table was missing a toggle the admin panel offers, and three workspace rows sat outside the table they belonged to, so they rendered as literal text on the published page rather than as rows. Both are fixed. The tool server pages describe authorizing an external account as something bound to the person who started it and the browser session they started it in, with the reasons it can be refused and what each one looks like, and the stale troubleshooting heading now matches the message the application actually produces.
The permission entry said the attach webpage option is hidden from people who do not have the permission. The option stays in the menu, greyed out with a tooltip explaining why, and an attach sent anyway is refused, so the entry now describes what a user actually sees. The permission tables now match the interface row for row, with the parent and dependency markings applied consistently to the skills rows the same way they are to models, prompts and tools.
Personal usage figures cover a fixed two year window for every account, rather than starting from the date the account was created, and the analytics dashboard now says what a custom range does before both dates are filled in: it sits idle rather than loading indefinitely, and the dates are remembered between visits so an incomplete range shows empty figures on return. The streaming entry no longer claims the characters that trigger it are common in documents. They are rare in ordinary text, and the entry says so, so nobody reads it as a likely cause.
…rules LM Studio joins llama.cpp as a provider type that Open WebUI can manage models on, so the OpenAI-compatible guide gains a section for the admin panel under Settings > Admin > Models > Manage: which of list, download, load, unload and delete each provider supports, that the chat connection URL works as-is because the /v1 suffix is stripped, and that the model selector's Eject button covers llama.cpp only. The llama.cpp guide and the LM Studio tab point at it. The automation docs were left wrong by the tool change: they said a blank folder_id clears the folder on update_automation, which is now the opposite, and a blank model_id is now ignored rather than applied. list_automations is unchanged, so the two are stated separately. The new Refresh button beside Cache Base Model List is deliberately undocumented: it calls getModels() without the refresh flag, so it re-reads the same cache and reports success without refreshing anything.
Pulling a model for a llama.cpp or LM Studio connection no longer requires the management panel: typing a ref into the model selector search offers a download row per target, so the section says how that works, that arrow keys and Enter reach the rows, and that three downloads run at once across all targets. Model rows for these providers also show parameter size and quantization now. The Delete entry the row menu gained for llama.cpp is left undocumented: it is wired to Ollama's delete API, so using it on a llama.cpp model fails. The management panel remains the documented way to delete.
Typing @ in a channel now looks up that channel's members and lists them ahead of the global user search, so the page says so where @username is introduced. The useful part for a reader is that non-members still appear below the members and can be tagged.
Tool Permissions is a new experimental admin toggle that lets a user put a model into "ask for approval", where a reply stops at each tool call until it is allowed or denied. The tools page gains a section covering the two modes, that the choice follows the user rather than the chat, that a denial reaches the model as an error, and that Stop finalizes a reply left waiting. Automations and channel replies always run with full access, since nobody is there to approve anything. ask_user is the other half: a builtin tool that pauses the reply and puts a question card above the message box. It needs a saved chat, because the pending question is stored on the assistant message, and it has to be the only tool call in its turn. ENABLE_TOOL_PERMISSIONS is documented alongside the other chat ConfigVars.
The CVE Program opened a formal dispute with huntr / Protect AI under Rule 4.1 on 2026-08-12, the CNA agreed to withdraw the same day, and cve.org updated all nine records to REJECTED on 2026-08-13. Each disposition page now carries the resolved notice, the withdrawal in its timeline and the closing state, matching the treatment the earlier withdrawals already had, and the index marks them CNA REJECTED. CVE-2024-7036 is recorded from the record state alone, since no reply for it was seen. The INCIBE page said CVE-2024-7053 was not withdrawn and its dispute still open, which no longer holds.
The CNA agreed on 2026-07-08 that these records should be annotated as disputed or rejected, and nothing has changed on cve.org since. Four follow-ups went unanswered, including one into the dispute ticket thread, so a fresh request went to the CVE Program for each record on 2026-08-14 asking it to carry out the update the CNA already agreed to. The pages now say that plainly: the substantive dispute is settled and what remains is the record update itself.
The CNA replied on 2026-08-12 like it did on the other eight records; the page was written from the record state alone because that reply was not to hand at the time. Its timeline now matches the rest of the batch.
Both pages stated that no corresponding report had reached the project before publication. A search of every advisory we hold shows that is not true for these two. For CVE-2024-8060 a report on the same endpoint and the same sink arrived on 2024-07-23, eight months before publication, without the traversal and code execution the record asserts. For CVE-2024-7046 the endpoint appears in a report from 2024-10-10, in passing and under a different subject, and the identifier had already been reserved on 2024-07-23. Neither reached us through the issuing CNA. The seven other pages carrying the same sentence are consistent with what the data shows.
The six records withdrawn in July already say that the huntr report page still shows the report as Valid with a green check and its status as Awaiting fix, while the CVE field on the same page reads Rejected. That is true of all fifteen, so the nine withdrawn on 2026-08-13 now carry the same note.
The default warning badge is white on solid amber, roughly 1.7:1, which is hard to read in light mode and worse in dark. It now uses a tinted background with text in the same hue, dark gold on light and light amber on dark, matching how the rejected-row highlight is already drawn. The class is used only on the disposition timelines.
…val shortcuts The slash command list said four commands act on the current chat, which no longer holds: /settings acts on the interface, and /temporary is offered only before a chat exists, since the setting cannot change once messages are saved. It is also withheld when the permission is absent or an administrator has enforced temporary chat. Allow tool call and Deny tool call join the shortcut table and the tool approval section. They act on the most recent call still waiting, so several pending calls are answered one keypress at a time, and they do nothing at any other moment.
The Provider dropdown in a connection's Advanced section was only described piecemeal, so it was not clear what picking llama.cpp, LM Studio, LiteLLM or Azure OpenAI actually changes, and the LiteLLM option was not mentioned in the connection guides at all. Add a reference section on the OpenAI-compatible page listing every option and what it switches on, and link the existing llama.cpp, Azure, reasoning and API pages to it. Also correct the naming: the setting is a Provider dropdown hidden behind Advanced, not a Provider Type toggle button, which is what the Azure and LM Studio instructions still described.
All fifteen records carry the REJECTED state on cve.org while the corresponding reports remain published as valid and awaiting a fix, so the matter has been raised with the CVE Program and each timeline now says so, citing the CNA rule that requires published information not to contradict the record. The six records withdrawn in July say the CNA was unresponsive to the direct request of 2026-08-08. The nine withdrawn in August do not, since they were not yet withdrawn when that request was sent and no direct request about their status has gone out.
CVE-2024-7999, CVE-2024-9840 and CVE-2024-12868 were assigned against this project by huntr / Protect AI, published on 2025-03-20 and withdrawn by that CNA on its own initiative twenty-six days later. No report on any of them reached the project's reporting channel, and no notification of the assignment, the publication or the withdrawal was received. Their existence was established sixteen months afterwards by reconstructing them from the version history of the CVE Program's record repository, since descriptions and references are stripped on rejection. Each page carries the recovered claim so a reader can see what was asserted, states plainly that Open WebUI has not assessed any of them on the merits, and records the two things that make them worth documenting: the record was live and ingested downstream for twenty-six days, and the corresponding report is still presented as valid and awaiting a fix on the CNA's platform sixteen months after withdrawal.
Two things follow from the record's own text without assessing the claim, and the page now states both. The weakness is attributed to a dependency reached through fastapi, and the remedy the record names is a release of that dependency chain rather than a change to Open WebUI. The record also never shows the condition is reachable here: it names no endpoint, no request and no path, only that a vulnerable version is present in the tree.
The 9.00 CRITICAL on a withdrawn identifier is the sharpest illustration of what the gap costs, and it sat mid-page as a single paragraph. It now opens the page as a four-way comparison: the record is rejected on cve.org, the issuing CNA claimed 7.6, we hold the chain cannot occur, and the national CERT presents 9.00. The sequence is stated too, since the CNA assigned 7.6, the listing raised it, and the CNA then withdrew the record, leaving the highest of the four scores as the one nobody stands behind.
The page described a flow that does not exist: multiple named keys, a one-time key display and a delete button. It also pointed at an admin path that has since moved. Readers followed it, found the section in Settings > Account apparently empty and concluded the feature was broken. Rewritten against the shipping behaviour. Each account holds exactly one unnamed key, creating a key overwrites the previous one and the key stays viewable afterwards. The API keys section is collapsed behind a Show button, which is the actual reason it looks empty, so that is now called out in the setup steps and in troubleshooting. The admin toggle lives under Admin Panel > Settings > Authentication. Also documents what endpoint restrictions really match (exact path or path-segment prefix, instance-wide rather than per key) and the causes of a 403, since the global toggle and the feature permission are re-checked on every request and turning either off revokes existing keys immediately. Headings are unchanged except the Limitations entry claiming keys cannot be viewed after creation, which states the opposite of what happens and is replaced by the one-key-per-account limit.
… does nothing Chat variables and prompt input variables share the same field syntax, so writing the prompt form of it into a model's system prompt looks correct and fails silently: no control appears next to the chat input, no form opens, and the placeholder reaches the model as literal text. Nothing in the editor flags it either, since a placeholder without the prefix is dropped before the Detected Variables list is built. The chat variables section now calls the prefix out explicitly and names Detected Variables as the way to check, and the prompts page says up front that its syntax is for prompt content and points at chat variables for system prompts.
The context management section still said Open WebUI ships no way to handle a full context window and sent everyone straight to writing a filter Function. Context Compaction has covered the common case for a while now, so a reader following that page was being told to build something that already exists. It now leads with compaction: what it does, that an administrator has to turn it on first and where, the threshold to set, and the two limits worth knowing before relying on it, that crossing the threshold does not guarantee it ran and that the token figure is an estimate where the provider reported none. Filter Functions stay as the answer for any other policy. The troubleshooting page also gains the Retained Messages setting, which the admin panel has but its list was missing.
…inal A terminal connection now carries a Chat Uploads field, and the interface gives no explanation of what its Filesystem option does. Choosing it changes where every file attached in the chat input ends up. The file is written into the terminal's current working directory rather than uploaded to Open WebUI, no text is extracted from it, no retrieval runs over it, and the model is given the path so it can open the file with the terminal's own tools. An operator reading the connection form has no way to tell that from the label, and a user whose attachment stops behaving like a document has no way to tell why. The connection guide gains a section covering both values and the four consequences that catch people out: the model no longer has to declare file upload support, the path reaches the model only when it is using native function calling in a saved conversation, an image is written to the working directory instead of being shown to the model, and Open WebUI's file size and attachment count limits are still enforced. The file browser page picks up the chat input as a second route into the working directory it displays, and the environment variable reference describes the matching connection config key for deployments configured at startup. This behaviour exists only on the application's dev branch and is in no tagged release, so it is documented on dev alone.
An MCP connection using either OAuth 2.1 mode now carries an Authorize OAuth button next to Register Client, and it removes a step that was easy to get stuck on. Until now the only way to complete the handshake was to leave the admin settings, open a chat and enable the tool there, which meant an admin setting a server up for other people had no way to find out whether the flow worked without pretending to be one of them. The button issues the same authorization request that enabling the tool in a chat issues, and the grant lands against the admin's own account on the same terms, so the account section is where it is described. It appears only after a client is registered and does nothing until the connection has been saved, both of which are worth stating because the button silently changes state rather than explaining itself. Finishing the flow drops the browser back on the home page rather than the settings dialog, which is the kind of thing a reader should not have to discover. The verify button on those same connections now reads Check OAuth Discovery and reports OAuth discovery successful. That relabelling matters more than it looks: the button fetches and parses the OAuth discovery document and stops there, never contacting the MCP server and never listing a tool, so a green result has always been weak evidence that anything works. The troubleshooting entry for a tool that fails in chat despite a passing check now says so directly, and the authentication section carries the full explanation alongside the note that the check honours the OAuth Server URL field on static connections, which it previously ignored in favour of the MCP URL. This behaviour exists only on the application's dev branch and is in no tagged release, so it is documented on dev alone.
…ew may do The latest development commit adds two toggles for the preview sandbox, one for scripts and one for downloads, and turns the forms toggle on by default. None of the sandbox settings were documented, so the artifacts page now lists all four with their defaults and what each permits. The same-origin toggle is the one with a security consequence and it is called out separately. With it on, script inside a preview is same-origin with the application and can reach the session rather than being confined to the frame, so the page says to leave it off unless the error covered in troubleshooting requires it. The other three describe what the content may do inside its own frame, which makes them the way to render something untrusted while keeping it inert.
# Conflicts: # docs/features/chat-conversations/chat-features/conversation-organization.md # docs/features/open-terminal/setup/connecting.md # docs/security/supply-chain-security/vulnerability-databases/vulners.mdx # docs/security/vendor-dispositions/cve-2026-0765.mdx # docs/security/vendor-dispositions/cve-2026-0766.mdx # docs/security/vendor-dispositions/cve-2026-0767.mdx # docs/security/vendor-dispositions/index.mdx
The latest development commit adds a toggle for scripts and one for downloads, and turns the forms toggle on by default. None of the sandbox settings were described anywhere, so the artifacts page now lists all four with what each permits, and singles out the same-origin one because it is the only one with a consequence beyond the frame: with it on, script inside a preview shares the application's origin and can reach the session rather than being confined. The interface defaults page carried two of the keys and is corrected alongside it. The two new keys are added, and the forms default is updated from false to true to match the change.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
open-webui-docs-search | 734f618 | Aug 23 2026, 08:09 PM |
… a removed plugin Open Terminal can now put a file into the assistant's reply instead of opening the file viewer. The file browser page describes what arrives, a card carrying the file name, a preview using the same renderers the browser uses, and buttons to download it or open it there, along with a screenshot. It also records the two properties that follow from the card reading the file through the viewer's own access: nothing is copied out of the terminal and no public link exists, so a card works only while that terminal is connected and selected. Settings gains a Terminal File Display preference deciding which of the two happens when the model does not ask for one, so that is documented alongside, and its key is added to the interface defaults table with its sidebar default. Separately, Fork Chat is removed from the community plugins list.
Every SCIM user operation is now scoped to accounts that carry an identity provider, meaning those created by SCIM itself or by an OAuth or OIDC sign-in. A locally created account, including the first administrator and anyone added by hand, is no longer listed and is not addressable by id, so a read, update or delete against one answers 404 where it previously reached the account through the general user lookup. The operations list said it returned all users, which is no longer true, and now records the scoping along with the one route by which a local account becomes visible, which is signing in through the provider.
An account's key can now be removed outright rather than only overwritten by a new one. The page described rotation as the only way to retire a credential, so it now says a key can be replaced or deleted, and that deleting leaves the account with none until another is created. The generation steps gain the mechanics, since the rotate control moved: with a key present, the menu beside it offers creating a replacement and deleting, and deletion asks for confirmation before it takes effect. The rotation advice distinguishes the two, because rotation hands an integration a fresh credential while deletion ends that account's access, which is what retiring an integration calls for.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.