dalao.ai

Open WebUI

Self-hosted AI interface

About Open WebUI

Open WebUI is a self-hosted chat front end for AI models. It connects to a local Ollama or any OpenAI-compatible API with multi-user accounts, role-based access, document retrieval, web search, plugins, voice calls and an admin console; it installs with Docker or pip. Timothy Jaeryang Baek started it; Open WebUI Inc. maintains it. As of 2026-10-25 it has 156,658 GitHub stars and the latest stable release is v0.12.3 (2026-10-16). The license is BSD-3 plus a branding clause: internal use with the logo intact is free; rebranding for over 50 users needs written permission or an enterprise license.

EditorialUpdated 10 min read

The Open WebUI interface

What it does

Plenty of organisations want a ChatGPT-style interface for staff without sending data to a third party, and often with several model sources at once: open models served locally, OpenAI, Anthropic, and an in-house inference cluster. Open WebUI is the front desk for all of that. Accounts, permissions, knowledge bases, tools and usage tracking live in one place, whatever the model behind it.

It started life closer to Ollama than its name now suggests. The old address github.com/ollama-webui/ollama-webui 301-redirects to open-webui/open-webui as of 2026-10-25, so the project was once Ollama WebUI. Today the README calls it a self-hosted AI platform that can run fully offline, with native Ollama support plus any OpenAI-compatible endpoint, naming LM Studio, GroqCloud, Mistral, OpenRouter and vLLM as examples.

The README groups its features four ways. On the chat side it covers parallel multi-model answers, Markdown and LaTeX, voice and video calls, and image generation and editing. On the knowledge side, local RAG over nine vector stores (ChromaDB, PGVector, Qdrant, Milvus, Elasticsearch, OpenSearch, Pinecone, S3Vector, Oracle 23ai), hybrid search and dozens of web-search providers. Extensibility comes from five plugin types (Filters, Actions, Pipes, Tools, Skills) plus MCP and OpenAPI tool servers. Administration includes groups and fine-grained roles, LDAP/AD, OAuth SSO, SCIM 2.0, OpenTelemetry and Redis-backed horizontal scaling.

Repository snapshot from the GitHub API on 2026-10-25: created 2023-10-07 06:08 (UTC+8), Python, 156,658 stars, 22,807 forks, 673 watchers, 196 open issues and PRs, last push 2026-10-25 07:33 (UTC+8). GitHub reports the license as NOASSERTION because it's a custom text, not an SPDX identifier.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform designed to operate entirely offline.

Open WebUI README

Key features

GitHub lists 175 releases, all stable, none flagged as prereleases, starting with v0.1.102 on 2024-02-23. Minor versions: v0.7.0 (2026-01-10), v0.8.0 (02-13), v0.9.0 (04-21), v0.10.0 (06-30), v0.11.0 (07-27) and v0.12.0 (10-11). Within six days of v0.12.0, three point releases followed: v0.12.1, v0.12.2 and v0.12.3.

According to its notes, v0.12.0 (2026-10-11) added realtime voice calls on the OpenAI Realtime API. The default model is gpt-realtime-2.1-mini with the Marin voice, and calls end after an hour. It also added VRM avatars up to 25 MiB, multi-factor authentication behind ENABLE_MFA with ten recovery codes, and replies on shared chats.

v0.12.3 (2026-10-16) brought end-to-end encrypted chats for DMs and private group channels. Encryption happens in the browser using MLS, messages are capped at 16 KiB and nothing is stored on the server. The feature sits behind ENABLE_ENCRYPTED_CHANNELS and is off by default. The same release lightened Redis streaming and added Compare view options.

The README gives pip, uv, Docker or Kubernetes via kubectl, kustomize or helm as install options. Image tags include :main, :cuda and :ollama (bundled Ollama). There's also :dev, which the README warns carries unstable features. HF_HUB_OFFLINE=1 stops model downloads in air-gapped setups. Storage options are SQLite (optionally encrypted) or PostgreSQL, with files on local disk, S3, Google Cloud Storage or Azure Blob.

Companion repos round it out. Open Terminal gives agents a shell and filesystem, and Terminals is its enterprise multi-user edition. oikb syncs 45+ sources such as GitHub, Confluence, Jira, Slack and Notion into knowledge bases. A desktop app runs on macOS, Windows and Linux.

How it compares

Open WebUI keeps its own alternatives page (updated August 2026). It recommends LM Studio or Jan for a desktop app, AnythingLLM for document Q&A, LibreChat for multi-provider chat and Dify for workflows, alongside Ollama, llama.cpp, Msty, Onyx and three commercial products: ChatGPT, Claude and Gemini. This is the project's own positioning.

GitHub figures for comparable self-hosted chat front ends, as of 2026-10-25. LibreChat: 46,262 stars, MIT, now at LibreChat-AI/LibreChat after moving from danny-avila. AnythingLLM: 67,520 stars, MIT, built around document workspaces. LobeHub, formerly LobeChat: 83,471 stars under the LobeHub Community License, which adds commercial conditions for derivative works on top of Apache 2.0. Open WebUI has 156,658.

LDAP, SCIM 2.0, group permissions, OpenTelemetry and multi-node scaling are listed in Open WebUI's README and ship in the free community edition; the teamazing review also notes that SSO, OIDC and LDAP cost nothing. On licensing, LibreChat and AnythingLLM are MIT; Open WebUI restricts rebranding by user count.

Who uses it, and who it's for

On scale, the GitHub contributors API shows 389 linked accounts (2026-10-25). The homepage claims 429M+ downloads, 520K+ community members and 157K+ stars; those are the vendor's own figures, as of 2026-10-25.

The enterprise page lists customer stories, all self-reported. Samsung Semiconductor says complex workflows went from days to hours. Public Storage reports about 50% active adoption within 30 days on GCP and an 80%+ cut in one workflow. Astellas says 3,000+ employees built and shared 420+ custom models on Azure, with 68% reporting significant efficiency gains and an NPS of +43. JGU Mainz's AI architect says the university uses it as the chat front end for 30,000+ students and 5,000+ staff.

On the company: the README credits Timothy Jaeryang Baek as creator, the LICENSE names Open WebUI Inc. as copyright holder, and LICENSE_HISTORY shows Baek personally held copyright on the early code (2023–2025). teamazing's review (2026-08-05) says the company has raised about US$40k, via the Mozilla Builders and GitHub accelerators.

Who it's for

IT teams, university computing centres and internal platform groups that need one AI chat entry point for dozens to thousands of people, with data kept on their own hardware or cloud account. Also teams already running Ollama, vLLM or several APIs who want one place to manage them, and developers building internal assistants from plugins, MCP tools and knowledge bases.

Not for

Solo users who just want to chat with a model on their laptop; a desktop app is lighter. Teams with nobody to patch a server: releases and advisories arrive often, and an unpatched instance gets riskier over time. And anyone planning to resell it under their own brand to more than 50 users without a written permission or an enterprise license.

Getting started

Installing with Docker: with Ollama already on the host, the README command is docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-webui:main. Then open http://localhost:3000 and create the admin account. Per the Quick Start, that first account is the administrator, and sign-up switches itself off once it exists. To let others in, re-enable new sign-ups in the admin settings; each new account then waits as Pending until an admin approves it. For OpenAI only, pass OPENAI_API_KEY. Use :ollama to bundle Ollama, or :cuda with the NVIDIA container toolkit for GPU work.

With pip, run pip install open-webui, then open-webui serve. Three sources give Python requirements. The README says 3.11. PyPI metadata for 0.12.3 (uploaded 2026-10-16) allows 3.11 up to, but not including, 3.13. The Quick Start says Docker or the latest 3.11 for production, that 3.12 works with rare oddities, and that 3.13 isn't supported.

The security policy supports only the main branch; dev and everything else are unsupported.

Pricing & license

Internal use with the branding exactly intact is free, and the FAQ on the alternatives page says the community edition has no user cap. Enterprise licenses go only to registered organisations. Sales asks for a work email and an expected seat count, and doesn't answer personal addresses. White-labelling, rebranding and enterprise-only pieces such as Terminals require that license.

The LICENSE is BSD-3 plus a fourth clause: licensees may not alter or remove the Open WebUI branding unless one of three conditions holds. Either no more than 50 end users (natural persons with direct access) in any rolling 30-day period, or specific prior written permission from the copyright holder, or an enterprise license. LICENSE_HISTORY draws two lines by commit: code created before 60d84a3 is under BSD-3 (copyright Timothy Jaeryang Baek, 2023–2025), and code created before the earlier commit a76068d (2025-01-11) is under MIT. The license docs mention only that v0.6.5 and earlier are BSD-3 and free to fork; they say nothing about the MIT period. Contributors sign a CLA.

The docs and the LICENSE differ in three places. First, the effective boundary. LICENSE_HISTORY places code created before commit 60d84a3aae9802339705826e9095e272e3c83623 under BSD-3, drawing the line by commit rather than by release tag; that commit's committer date is 2025-04-19 05:49 (UTC+8), message chore: license "branding" clause. The GitHub Release for v0.6.5 is dated 2025-04-14 17:13 (UTC+8), and the one for v0.6.6 2025-05-05 21:59 (UTC+8). The license docs say "Effective with v0.6.6 (April 19, 2025)" and that all code submitted or merged up to and including v0.6.5 remains BSD-3. Second, the docs describe the written-permission condition as applying to a "substantive contributor", while the LICENSE asks only for specific prior written permission. Third, the docs call the 50-user threshold an aggregate ("50+ users, aggregate"), while the LICENSE counts end users in any rolling 30-day period. Where they differ, the LICENSE text governs.

Risks & limits

As of 2026-10-25 the GitHub Advisory Database lists 168 advisories for pip/open-webui, and the repo's own page shows 166.

Some advisories, with GitHub's severity and score. CVE-2026-44551 (GHSA-2r4p-jpmg-48f4) is an LDAP empty-password authentication bypass, critical at 9.1. Its structured range says up to 0.8.12, fixed in 0.9.0, but the advisory text says "current main branch (commit 6fdd19bf1) and likely all versions with LDAP", and NVD says "prior to 0.9.0". NVD hasn't scored it itself and carries only GitHub's CNA score of 9.1. CVE-2026-87995 (GHSA-jmc6-2wr8-h3wj) is an XSS in the terminal port-preview iframe that can lead to account takeover. It's high at 8.7, affects 0.8.11 through 0.11.0 and is fixed in 0.11.1; NVD again shows only the CNA's 8.7. CVE-2026-87016 (GHSA-wpmr-8h3q-fwj7) is an OAuth subject wildcard match on SQLite, high at 8.1, affecting 0.6.41 up to 0.11.1; NVD shows only the CNA score. GHSA-vpq8-f445-hcq7 corresponds to CVE-2026-109286. The repo advisory is titled "Any website can steal a signed-in user's session token via the community stats message handler", and GitHub rates it high at CVSS 3.1 8.1. It affects 0.7.0 up to, but not including, 0.11.4, is fixed in 0.11.4, and requires ENABLE_COMMUNITY_SHARING, which is on by default. The advisory page itself carries no CVE id. It was published on 2026-09-28 but never entered the global GitHub Advisory Database (the global API returns 404), so it isn't among the database's 168. NVD ingested it as CVE-2026-109286 on 2026-10-13 01:17 (UTC+8) with VulnCheck as CNA, status Awaiting Analysis; NVD hasn't scored it itself, and the only scores shown are VulnCheck's CVSS 3.1 8.1 and CVSS 4.0 8.6. GHSA-3vvh-g22g-jq6r is webhook spoofing in channels, medium at 4.3, published 2026-10-19 03:50 (UTC+8) and affecting 0.7.0 up to, but not including, 0.12.2. It needs ENABLE_CHANNELS, which is off by default; the advisory carries no CVE, and NVD has no matching record.

The project has its own view of all this. Its security policy says a visible advisory history shows active scrutiny, not fragility, and that high-impact issues may stay embargoed for up to about two weeks after a patch. The page, updated 2026-10-23, adds a newer rule: no advisory goes public until GitHub has assigned its CVE, which at GitHub's current pace pushes publication back two to five weeks. The project says it made the change after VulnCheck, without contacting it first, assigned CVEs on 2026-10-12 to 19 advisories it had published on September 27 and 28, which led GitHub to reject the project's own 19 requests as duplicates (the vendor's account). Its Vendor Dispositions page says a substantial share of recent CVEs against it have not survived scrutiny, some published without notifying the vendor. Another page lists nine withdrawn IDs that several databases still show as live. These delayed-disclosure and CVE-process claims are the vendor's own official statements.

The license docs say the v0.6.6+ license isn't OSI-approved. Tools, functions and Pipelines run arbitrary code by design, and the security policy treats any attack chain through them as intended behaviour rather than a vulnerability. It tells admins to regard the workspace.tools permission as equivalent to root and to grant it only to people trusted with direct server access, because granting it to untrusted users means accepting the risk of arbitrary code execution on the host. The vendor says its deployment options give a technical foundation for SOC 2, HIPAA and similar frameworks, while compliance stays with the operator.

Our verdict

What sets Open WebUI apart: it is self-hosted and connects to a local Ollama and any OpenAI-compatible API; enterprise identity and access features such as LDAP, SCIM 2.0 and group permissions ship in the free community edition; it has 156,658 GitHub stars.

Its limits: releases come often (three point releases within six days of v0.12.0), the GitHub Advisory Database lists 168 advisories, and the security policy supports only the main branch; rebranding beyond 50 users needs written permission or an enterprise license.

Why it stands out

Open WebUI began as a front end for Ollama and grew into the most complete self-hosted chat interface in existence. Multiple users, document uploads with retrieval, image generation, function calling, model pipelines, and an admin panel that a small company can actually run.

Timothy Baek maintains a release cadence that would exhaust larger teams, and the project has become the reference implementation for what a private ChatGPT-class deployment looks like.

It is self-hosted and supports multiple users, document retrieval, image generation, function calling, model pipelines and an admin panel.

Sources

Official

  1. open-webui/open-webui (GitHub)GitHub · Accessed Oct 25, 2026
  2. Releases · open-webui/open-webuiGitHub · Accessed Oct 25, 2026
  3. Release v0.12.3 · open-webui/open-webuiGitHub · Accessed Oct 25, 2026
  4. Release v0.12.0 · open-webui/open-webuiGitHub · Accessed Oct 25, 2026
  5. Release v0.6.5 · open-webui/open-webuiGitHub · Accessed Oct 25, 2026
  6. open-webui/README.mdGitHub · Accessed Oct 25, 2026
  7. open-webui/LICENSEGitHub · Accessed Oct 25, 2026
  8. open-webui/LICENSE_HISTORYGitHub · Accessed Oct 25, 2026

Updates & reading