Open WebUI 0.11: Security and Privacy Changes

Open WebUI 0.11 landed on 27 July 2026, and it is the largest release the project has shipped in a long time. The interface was rebuilt from the ground up, and a long list of genuinely new capabilities arrived with it.

Start somewhere else, though. This release includes security and access-control fixes, and the project recommends updating production deployments promptly. The release notes also state plainly that not every security fix is enumerated, because some are withheld for a short window to give administrators time to upgrade.

If you run Open WebUI on a box that anyone other than you can reach, that advisory is the reason to act on this release. The features are the reason to enjoy it afterwards.

The security picture

Several of the fixes describe problems worth understanding, because they tell you what to check on your own instance.

Cross-site scripting through file preview. Previewing an HTML file in the system terminal now runs in an isolated context by default. Previously this could expose a login session, or for privileged accounts, run code on the server.
Cross-site scripting through malformed mathematics. Maths that fails to render is now shown as plain text rather than injected as markup, closing a route by which a crafted formula in a chat, channel, or shared conversation could run code in a reader's browser.
Deactivated accounts kept live access. Real-time connections now apply the same role check as the rest of the application, so an account removed from its role can no longer hold channels and shared notes open on an existing token.
Writing into another person's chat. Completion and action requests now confirm chat ownership before writing.
Anonymous version disclosure. Reading the configured Ollama backend version now requires signing in.

There is a longer list covering knowledge-base scoping, folder deletion permissions, tool source disclosure to read-only users, and outbound request handling. The pattern across them is multi-user access control, which is exactly the surface that grows when a personal tool acquires sharing features.

The three features that change the privacy posture

Sub-agents

Administrators can now enable sub-agents, which let a model hand parts of a task to background helper agents. Those helpers run their own tool-driven conversations and report results back into the chat. New settings govern the feature: ENABLE_SUBAGENTS, plus concurrency, iteration, and system-prompt controls.

The privacy consequence is arithmetic. One user message can now become many model calls and many tool invocations, including web searches, each of which is a separate outbound request. If you were reasoning about egress by counting the messages you typed, that reasoning no longer holds. The concurrency and iteration limits exist for exactly this reason and are worth setting deliberately rather than leaving at whatever the default is.

Sub-agents are administrator-gated, which is the correct default.

A shared chat can now be set to Open, meaning it opens without signing in, and visitors are no longer bounced to a sign-in page on the way.

The guardrails here are better than the headline suggests, and they deserve credit. Open sharing requires a new Chats Open Sharing permission that an administrator must grant, and that permission is off by default. Open shared pages also ask search engines not to index them.

Two things to keep in mind anyway. A request not to index is a request, honoured by cooperative crawlers and ignored by everything else. And a link that works without authentication is a credential: anyone who receives it, forwards it, or finds it in a browser history has the conversation. If your instance holds anything sensitive, leaving that permission off is a defensible policy rather than a paranoid one.

Timers and assistant-initiated notifications

Two related additions. The assistant can now set a timer that brings a prompt back into the conversation later, after a delay or at a set time, and can drop it if you read or reply first. Separately, the assistant can now send you a notification when something warrants attention.

Notifications also got a dedicated settings tab supporting several webhook destinations, each subscribing to the events it wants, from chats finishing or failing through to channel messages and calendar alerts, with a test button and a choice between always notifying and only notifying when you are away.

Webhooks are the item to think about. A notification destination is an outbound connection carrying information about your activity to a third-party endpoint. That is the entire point of the feature, and it is a good feature. It is also a data flow that did not previously exist on your instance, and it is worth deciding which events genuinely need to leave.

Taken together, timers plus notifications mean the assistant can now act, and reach you, when you are not looking at it. That is a meaningful shift for a tool many people ran precisely because it only did things while they watched.

Everything else worth knowing

The release is enormous, so a compressed tour of the rest:

Organisation. Folders now have their own pages with paging and sorting. Unread tracking arrived across folders and the sidebar. Chats can be forked from any response into a new conversation that remembers where it branched. Long conversations can be compacted on demand rather than waiting for the automatic threshold.

Collaboration. People with access to a shared folder can use its files and system prompt as knowledge in chat, and manage the folder with write access. Administrators can restrict sharing with entire groups through a new permission, and can synchronise LDAP groups to Open WebUI groups.

Context handling. A new Files capability lets the model list the files attached to a chat and search them by meaning or exact text, reading only what it needs rather than having whole documents pushed into the conversation up front. Chat variables let a system prompt declare fields you fill in per conversation. User variables let you store your own values in account settings for a system prompt to insert.

Administration. New controls for context compaction thresholds and retained message share, a dedicated summarisation model, knowledge tool output limits, model ordering, streaming idle timeouts, and the ability to disable the Tools and Functions plugin surfaces entirely.

Performance. A very long list, and unusually specific: faster chat search on PostgreSQL, cheaper filter handling while streaming, fewer database round trips almost everywhere, faster folder loading, lighter model lists, and an optional faster JSON encoder behind ENABLE_ORJSON that stays off by default because it is stricter about input.

Accessibility. A substantial pass covering keyboard navigation, screen reader labelling, and high contrast mode. This is the sort of work that rarely gets a headline and materially widens who can use the tool.

The short version

Open WebUI is no longer well described as a browser interface over Ollama. It is a multi-user AI workspace with delegation, scheduling, notification routing, and collaborative document handling, which happens to speak to Ollama among other backends.

That is a more capable product and a larger attack surface, and 0.11 is a release where both halves of that sentence arrived at once. Update for the security fixes. Then go through the new permissions, one at a time, and decide which ones you actually want on.

*Release contents verified against the official Open WebUI v0.11.0 release notes on 9 August 2026. Administrators should consult the project's security advisories directly for fixes not enumerated in the release notes.*

Open WebUI 0.11: Security, Sub-Agents, Sharing, and Timers