RepoJournal
Open WebUI @open-webui
73 wires and counting

$ follow Open WebUI

Keep up with Open WebUI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-20
stories 58
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Fix SSRF redirect in OAuth picture fetch

By RepoJournal · Filed · About Open WebUI

Classic298
1 person shipped this
Classic298 @Classic298 5 cited

Open WebUI patched a server-side request forgery in OAuth picture fetching by disabling redirect following.

A security fix landed in the OAuth picture fetch path [1]. _process_picture_url validated the initial URL with validate_url(), but aiohttp followed 3xx redirects without re-validating the target. A public URL that passed validation could redirect to an internal address, and the response body would be base64-stored in the user's profile_image_url. This was the sixth call site in the CVE-2026-45401 redirect-bypass cohort; the other five already pass allow_redirects=AIOHTTP_CLIENT_ALLOW_REDIRE... Now redirects are disabled, closing the SSRF vector.

Alongside the security fix, several dead frontend wrappers and their corresponding API endpoints were removed [2][3][4][5]. The generateFollowUps wrapper targeted a non-existent path, and follow-up suggestions are generated server-side. The bulk-clear-chat-tags endpoint, the lookup-prompt-by-command endpoint, and the server-side markdown rendering endpoint all had no callers; markdown is rendered client-side. These removals simplify the codebase without changing user-visible behavior.

Action items

References

  1. [1] fix: disable redirect following in OAuth picture fetch (SSRF) (#24809) ↗ open-webui/open-webui
  2. [2] refactor: remove dead generateFollowUps frontend wrapper (#24794) ↗ open-webui/open-webui
  3. [3] refactor: remove unused DELETE /chats/{id}/tags/all endpoint (#24785) ↗ open-webui/open-webui
  4. [4] refactor: remove unused GET /prompts/command/{command} endpoint (#24782) ↗ open-webui/open-webui
  5. [5] refactor: remove unused POST /api/v1/utils/markdown endpoint (#24779) ↗ open-webui/open-webui

$ ls open-webui/reviews/ # the step-back reads

the week in review Open WebUI 0.11.2 ships as nine security advisories land the month in review Open WebUI 0.11.1 adds tool approval, 0.11.2 fixes
Topics: Local LLMs AI / ML Full archive →

Quick answers

What shipped in Open WebUI on May 20, 2026?
Open WebUI patched a server-side request forgery in OAuth picture fetching by disabling redirect following. In total, 42 commits and 16 pull requests landed.
Who contributed to Open WebUI on May 20, 2026?
1 developer shipped this update, including Classic298.
What were the notable Open WebUI updates?
fix: disable redirect following in OAuth picture fetch (SSRF) (#24809), refactor: remove dead generateFollowUps frontend wrapper (#24794), and refactor: remove unused DELETE /chats/{id}/tags/all endpoint (#24785).
♥

$ log @open-webui --recent

Open WebUI ships five security fixes for auth and request handling 8 shipped Four breaking security advisories expose data and enable account takeover in Open WebUI 17 shipped Open WebUI 0.11.2 ships with tool parsing fix 90 shipped Fixes Redis Cluster stop, German catalog drift 8 shipped

$ log --all # elsewhere on the wire

@golang Fast-path receive buffer cleared on stream reset Meta React Native adds Stable API guards to renderer attributed string

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.