RepoJournal
Open WebUI @open-webui
73 wires and counting

$ follow Open WebUI

Keep up with Open WebUI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-01
stories 43
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Open WebUI removes hardcoded WEBUI_SECRET_KEY fallback, closes bypass_system_prompt hole

By RepoJournal · Filed · About Open WebUI

Classic298 amirsubhi macodev00 mhajder
4 people shipped this
Classic298 @Classic298 2 cited amirsubhi @amirsubhi 1 cited macodev00 @macodev00 1 cited mhajder @mhajder 1 cited

Open WebUI dropped the hardcoded WEBUI_SECRET_KEY default and moved bypass_system_prompt off the query string, closing two security gaps.

Open WebUI removed the hardcoded WEBUI_SECRET_KEY fallback [1]. The 't0p-s3cr3t' default was dead code on every supported startup path, including start.sh, start_windows.bat, and `open-webui serve`, all of which set or auto-generate the key before the backend imports env.py. It was only reachable by invoking uvicorn directly, which is unsupported and unsafe because the app would sign tokens and cookies with a public, hardcoded key. This is a breaking change for anyone launching via bare uvicorn; they must now export WEBUI_SECRET_KEY explicitly.

The same author moved the internal bypass_system_prompt flag off the query string and onto request.state [2]. Used by utils/middleware.py and utils/chat.py to skip the model system prompt on recursive base-model calls, it was still a positional argument on the OpenAI and Ollama chat-completion route handlers, so FastAPI bound it from the query string, letting external clients set it. The fix mirrors how bypass_filter is handled, and the argument was dropped from the route handlers.

Elsewhere, i18n work landed for Malay, Korean, and Polish [3][4][5]. The ms-MY translation fixes errors and standardizes terminology; ko-KR adds three missing `_one` plural keys that caused i18next to fall back unexpectedly; pl-PL fills in previously missing strings. One commit's description noted that the hardcoded fallback "keeps getting reported as a vulnerability" [1].

If you self-host and launch Open WebUI with bare uvicorn, export WEBUI_SECRET_KEY before upgrading; all other startup paths are unaffected.

Action items

References

  1. [1] fix: remove hardcoded WEBUI_SECRET_KEY fallback, require key explicitly (#25218) ↗ open-webui/open-webui
  2. [2] fix: move bypass_system_prompt off query parameter onto request.state (#25156) ↗ open-webui/open-webui
  3. [3] i18n: fix ms-MY (Malay) translation errors, standardize terminology and missing strings ↗ open-webui/open-webui
  4. [4] fix(i18n): add missing Korean plural _one keys in ko-KR translation ↗ open-webui/open-webui
  5. [5] i18n(pl-PL): add missing polish translations ↗ open-webui/open-webui

$ ls open-webui/reviews/ # the step-back reads

the week in review Open WebUI 0.11.2 ships as nine security advisories land the month in review Open WebUI 0.11.1 adds tool approval, 0.11.2 fixes
Topics: Local LLMs AI / ML Full archive →

Quick answers

What shipped in Open WebUI on June 1, 2026?
Open WebUI dropped the hardcoded WEBUI_SECRET_KEY default and moved bypass_system_prompt off the query string, closing two security gaps. In total, 24 commits and 19 pull requests landed.
Who contributed to Open WebUI on June 1, 2026?
4 developers shipped this update, including Classic298, amirsubhi, macodev00, and mhajder.
What were the notable Open WebUI updates?
fix: remove hardcoded WEBUI_SECRET_KEY fallback, require key explicitly (#25218), fix: move bypass_system_prompt off query parameter onto request.state (#25156), and i18n: fix ms-MY (Malay) translation errors, standardize terminology and missing strings.
♥

$ log @open-webui --recent

Open WebUI ships five security fixes for auth and request handling 8 shipped Four breaking security advisories expose data and enable account takeover in Open WebUI 17 shipped Open WebUI 0.11.2 ships with tool parsing fix 90 shipped Fixes Redis Cluster stop, German catalog drift 8 shipped

$ log --all # elsewhere on the wire

@golang Fast-path receive buffer cleared on stream reset Meta React Native adds Stable API guards to renderer attributed string

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.