Open WebUI’s November 8 release of version 0.13.1 includes security fixes and a database migration that makes the upgrade operationally significant. Deployments with multiple instances must coordinate the change rather than update replicas one at a time.
The maintainers recommend updating promptly, but have withheld the security details from the changelog pending CVE assignment. The notice does not identify the flaws, give severity scores or establish exploitation in the wild. Existing advisories should not be assumed to describe these particular fixes.
The release also introduces Tether, a desktop companion connecting a user’s computer to Open WebUI, and coding agents in the model picker. Its migration warning calls for backing up the database and associated data, and says mixed-version rolling updates will cause failures through schema incompatibility.
Check the follow-up releases
Version 0.13.2, also published on November 8, addresses failures when opening chats over plain HTTP at LAN or Docker addresses. It also fixes related comment and Markdown editing errors, and makes the Side Chat permission switch available independently of Temporary Chat.
By the time of this review on November 9, GitHub marked version 0.13.3 as the latest release. Published on November 8, it adds coding agents to automations and fixes further terminal-selection, agent-list and plain-HTTP clipboard problems. Administrators planning an upgrade should therefore review 0.13.3 rather than treat 0.13.2 as the current endpoint.
Plan the database change before restarting replicas
The project’s update documentation recommends pinning a specific version and testing in staging for production systems. For a schema-changing update, its procedure is to stop every replica, let one instance migrate the database, then start the remaining instances on the same new version. Disabling migrations on the other instances does not make a mixed-version deployment safe.
A recovery plan matters as much as the new image tag. Database migrations are one-way: starting an older container does not reverse them, and recovery may require a backup from before the upgrade. The documentation also recommends checking the running version and migration logs after updating, then loading the interface and clearing stale browser assets if necessary.
The immediate task is to combine the security update with a controlled migration and recovery plan. The undisclosed fixes warrant attention, while their specific impact remains awaiting public documentation.
