[GH-ISSUE #20819] issue: Model Tags Validation Missing - UI Breaks with Direct API Calls #106292

New Issue

2026-05-18T04:33:35-05:00

GiteaMirror commented

2026-05-18 04:33:35 -05:00

Originally created by @adhar-godaddy on GitHub (Jan 20, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/20819

Check Existing Issues

I have searched for any existing and/or related issues.
I have searched for any existing and/or related discussions.
I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.7.2

Ollama Version (if applicable)

No response

Operating System

macOS

Browser (if applicable)

No response

Confirmation

I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
Start with the initial platform/version/OS and dependencies used,
Specify exact install/launch/configure commands,
List URLs visited, user input (incl. example values/emails/passwords if needed),
Describe all options and toggles enabled or changed,
Include any files or environmental changes,
Identify the expected and actual result at each stage,
Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

Models should have properly formatted tags that adhere to the structure
expected by the UI components ([{"name": "TagName"}]), even when created or
updated via direct API calls.

Actual Behavior

Direct API calls can save model tags in any format since there's no backend
validation. When incorrectly formatted tags are stored in the database:

The model list API endpoint (http://localhost:8080/api/models) returns a 500 Internal Server Error
The UI gets stuck in an infinite loading state, displaying only a blank
white screen with the left sidebar

Steps to Reproduce

Set up Open WebUI v0.6.30 or even latest using Docker
Run both the backend and the UI of the Open WebUI
Make a direct API call to create or update a model with malformed tags (http://localhost:8080/api/v1/models/model/update?id=model-id)
Example payload containing invalid tags:

{
  "id": "test-model",
  "base_model_id": null,
  "name": "Test Model",
  "meta": {
    "profile_image_url": "/static/favicon.png",
    "description": "Test Model Description",
    "capabilities": {
      "vision": true,
      "file_upload": true,
      "web_search": true,
      "image_generation": true,
      "code_interpreter": false,
      "citations": true,
      "deep_research": true
    },
    "tags": ["tag1", "tag2"]  // Invalid format - should be [{"name": "tag1"}, {"name": "tag2"}],
    "deployment": null
  },
  "params": {
    "function_calling": "native",
    "moderation": {}
  },
  "object": "model",
  "created": 1677610602,
  "owned_by": "openai",
  "connection_type": "external",
  "openai": {
    "id": "test-model",
    "object": "model",
    "created": 1677610602,
    "owned_by": "openai",
    "connection_type": "external"
  },
  "urlIdx": 0,
  "user_id": "dfdfdfd8b6",
  "access_control": null,
  "is_active": true,
  "updated_at": 1756144344,
  "created_at": 1756144344
}

Go to the Open WebUI UI and observe that:
- The models API endpoint (http://localhost:8080/api/models) returns a 500 Internal Server Error
- The UI gets stuck in a loading/retry loop (see screenshot attached below)

Logs & Screenshots

UI keeps on loading forever:

Console error:

Additional Information

This vulnerability was discovered when testing direct API calls to update
models. While standard UI usage doesn't expose this issue (as the frontend
components enforce correct format), any system integration that uses the API
directly could introduce malformed tags that break the UI.

Originally created by @adhar-godaddy on GitHub (Jan 20, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/20819 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!). - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.7.2 ### Ollama Version (if applicable) _No response_ ### Operating System macOS ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior Models should have properly formatted tags that adhere to the structure expected by the UI components ([{"name": "TagName"}]), even when created or updated via direct API calls. ### Actual Behavior Direct API calls can save model tags in any format since there's no backend validation. When incorrectly formatted tags are stored in the database: The model list API endpoint (http://localhost:8080/api/models) returns a 500 Internal Server Error The UI gets stuck in an infinite loading state, displaying only a blank white screen with the left sidebar ### Steps to Reproduce 1. Set up Open WebUI v0.6.30 or even latest using Docker 2. Run both the backend and the UI of the Open WebUI 3. Make a direct API call to create or update a model with malformed tags (http://localhost:8080/api/v1/models/model/update?id=model-id) 4. Example payload containing invalid tags: ```json { "id": "test-model", "base_model_id": null, "name": "Test Model", "meta": { "profile_image_url": "/static/favicon.png", "description": "Test Model Description", "capabilities": { "vision": true, "file_upload": true, "web_search": true, "image_generation": true, "code_interpreter": false, "citations": true, "deep_research": true }, "tags": ["tag1", "tag2"] // Invalid format - should be [{"name": "tag1"}, {"name": "tag2"}], "deployment": null }, "params": { "function_calling": "native", "moderation": {} }, "object": "model", "created": 1677610602, "owned_by": "openai", "connection_type": "external", "openai": { "id": "test-model", "object": "model", "created": 1677610602, "owned_by": "openai", "connection_type": "external" }, "urlIdx": 0, "user_id": "dfdfdfd8b6", "access_control": null, "is_active": true, "updated_at": 1756144344, "created_at": 1756144344 } ``` 4. Go to the Open WebUI UI and observe that: - The models API endpoint (http://localhost:8080/api/models) returns a 500 Internal Server Error - The UI gets stuck in a loading/retry loop (see screenshot attached below) ### Logs & Screenshots UI keeps on loading forever: <img width="1503" height="651" alt="Image" src="https://github.com/user-attachments/assets/bcc8f17d-d910-49e4-97a8-6b25877f4d44" /> Console error: <img width="619" height="297" alt="Image" src="https://github.com/user-attachments/assets/436a11aa-6aa3-46d2-aca4-0fbedfa0c62b" /> ### Additional Information This vulnerability was discovered when testing direct API calls to update models. While standard UI usage doesn't expose this issue (as the frontend components enforce correct format), any system integration that uses the API directly could introduce malformed tags that break the UI.

GiteaMirror added the bug label 2026-05-18 04:33:35 -05:00

GiteaMirror closed this issue

2026-05-18 04:33:37 -05:00

GiteaMirror commented

2026-05-18 04:33:38 -05:00

@owui-terminator[bot] commented on GitHub (Jan 20, 2026):

🔍 Similar Issues Found

I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions:

#20361 Issue: Large-scale model setting-related functionality fails.
by shentong0722 • Jan 04, 2026 • bug
#19711 issue: Editing function for models broken
by skleffmann • Dec 03, 2025 • bug
#15271 issue: Models list api Fails
by dani01Lost4ever • Jun 24, 2025 • bug
#18711 issue: Duplicate model tags in dropdown
by thiswillbeyourgithub • Oct 29, 2025 • bug
#14453 issue: Tags cutting off when picking a model
by sharpener857 • May 28, 2025 • bug

Show 5 more related issues

#19615 issue: [TEST] Models Not Available to Users
by westbrook-ai • Nov 30, 2025 • bug
#19610 issue: Models not appearing for non-admin users
by westbrook-ai • Nov 30, 2025 • bug
#19103 issue: no response from the model when ask in "channels"
by silenceroom • Nov 11, 2025 • bug
#19194 issue: Prefix ID doesn't reliably show up in model names.
by MicahZoltu • Nov 15, 2025 • bug
#20048 issue: Public custom model access broken
by lochmaster • Dec 19, 2025 • bug

💡 Tips:

If this is a duplicate, please consider closing this issue and adding any additional details to the existing one
If you found a solution in any of these issues, please share it here to help others

This comment was generated automatically by a bot. Please react with a 👍 if this comment was helpful, or a 👎 if it was not.

@owui-terminator[bot] commented on GitHub (Jan 20, 2026): 🔍 **Similar Issues Found** I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions: 1. [#20361](https://github.com/open-webui/open-webui/issues/20361) **Issue: Large-scale model setting-related functionality fails.** *by shentong0722 • Jan 04, 2026 • `bug`* 2. [#19711](https://github.com/open-webui/open-webui/issues/19711) **issue: Editing function for models broken** *by skleffmann • Dec 03, 2025 • `bug`* 3. [#15271](https://github.com/open-webui/open-webui/issues/15271) **issue: Models list api Fails** *by dani01Lost4ever • Jun 24, 2025 • `bug`* 4. [#18711](https://github.com/open-webui/open-webui/issues/18711) **issue: Duplicate model tags in dropdown** *by thiswillbeyourgithub • Oct 29, 2025 • `bug`* 5. [#14453](https://github.com/open-webui/open-webui/issues/14453) **issue: Tags cutting off when picking a model** *by sharpener857 • May 28, 2025 • `bug`* <details> <summary>Show 5 more related issues</summary> 6. [#19615](https://github.com/open-webui/open-webui/issues/19615) **issue: [TEST] Models Not Available to Users** *by westbrook-ai • Nov 30, 2025 • `bug`* 7. [#19610](https://github.com/open-webui/open-webui/issues/19610) **issue: Models not appearing for non-admin users** *by westbrook-ai • Nov 30, 2025 • `bug`* 8. [#19103](https://github.com/open-webui/open-webui/issues/19103) **issue: no response from the model when ask in "channels"** *by silenceroom • Nov 11, 2025 • `bug`* 9. [#19194](https://github.com/open-webui/open-webui/issues/19194) **issue: Prefix ID doesn't reliably show up in model names.** *by MicahZoltu • Nov 15, 2025 • `bug`* 10. [#20048](https://github.com/open-webui/open-webui/issues/20048) **issue: Public custom model access broken** *by lochmaster • Dec 19, 2025 • `bug`* </details> --- 💡 **Tips:** - If this is a duplicate, please consider closing this issue and adding any additional details to the existing one - If you found a solution in any of these issues, please share it here to help others *This comment was generated automatically by a bot.* Please react with a 👍 if this comment was helpful, or a 👎 if it was not.

GiteaMirror commented

2026-05-18 04:33:38 -05:00

@tjbck commented on GitHub (Mar 25, 2026):

Addressed in dev.

@tjbck commented on GitHub (Mar 25, 2026): Addressed in dev.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#106292