36,769 Exposed Self-Hosted AI Endpoints: How to Check Yours
A dated summary of the September 2026 exposure count, and a check you can run on your own model server from your phone.
Founder, Newly
Published Last updated
Your Ollama or Open WebUI is exposed if its address answers a request from a network you do not control, such as your phone on mobile data. Ollama listens on 127.0.0.1 port 11434 by default, so reaching it from outside means the bind address was changed or the port was forwarded. A September 2026 research note counted 36,769 such endpoints, and about 2% returned an HTTP login challenge.
What did the September 2026 research find?
On September 15, 2026 the Cloud Security Alliance published a research note built on a count by Mysterium VPN researchers, who queried the Netlas internet-scanning index in September 2026. They matched servers by fingerprint and did not exploit or access live systems. The note calls 36,769 "a lower bound rather than a full census". We checked it on October 24, 2026.
| Software | Endpoints counted | Returned an HTTP authentication challenge |
|---|---|---|
| Open WebUI | 18,529 | 1 |
| Ollama | 6,935 | not broken out in the note |
| vLLM | 4,880 | 3 |
| Agent and workflow platforms (Flowise, n8n, ComfyUI, Dify, RAGFlow, Langflow) | 5,223 | 0 in the Flowise subset of 1,341 |
| Vector databases (Milvus, Attu) | 920 | not broken out in the note |
| LocalAI / llama.cpp | 150 / 69 | 0 / 0 |
How to read the 2% figure
The note's test was an HTTP 401 or 403 challenge, and 2.02% of endpoints returned one. Many apps draw their own sign-in page instead of sending that challenge, so the figure says how few had a gate in front of the server. It does not say that the rest had no sign-in page. Your own result needs the check further down.
Other measurements point the same way. A one-year study of Ollama, now on arXiv, found 152,137 cumulative exposed IP addresses between February 2025 and February 2026, and reports that across five CVEs only 0.43 to 2.90% of hosts below the fixed version upgraded in place. SentinelOne Labs counted 175,108 Ollama hosts over 293 days, with more than 48% advertising tool-calling. A server that can call tools is worth more to a stranger than one that only completes text.
Does this apply to an app built with AI?
Only if you run a model server, chat interface or agent platform yourself, or a client does. Typical cases: an Ollama box that the prototype talks to, an Open WebUI your team uses, an n8n or Flowise instance that sends email on the app's behalf. AI inside a Newly app uses credits, and credits do not change the exposure of a separate server you run.
There is a second route in. Expo writes every variable whose name starts with EXPO_PUBLIC_ into the app bundle, and the Expo docs say these are visible in plain text in the compiled application. If your model host address or a key for it sits in one, anyone who downloads the app has it.
The Ollama FAQ says it binds 127.0.0.1 port 11434 by default and that the bind address is changed with the OLLAMA_HOST environment variable. Widening that value, or forwarding the port from a router, container or cloud firewall, is how the first path becomes the second. The API reference lists endpoints to list local models, pull a model and delete one, and describes no authentication for any of them.
How do I check my own endpoint from outside?
Do this only for servers you own or run for a client with their consent. It takes about ten minutes.
1. Make the list
Write down every host that runs a model server, chat interface or agent tool, with its public address and port. Search your project for OLLAMA, 11434 and any base URL setting for an AI service. Include the server a former teammate set up for a demo. The LiteLLM team reported on October 21, 2026 an unexpected account in an internal deployment that was exposed to the public internet, and says it has not yet confirmed how the attacker first got in. Our gateway lesson covers that case.
2. Request each address from another network
Switch your phone to mobile data, turn Wi-Fi off, and open each address and port in the browser. A request from your office network can pass through rules that block strangers, or be blocked by rules that do not apply to them. Note what comes back: a reply from the software, a sign-in page, a 401 or 403, a refused connection or a timeout.
3. Read the settings on the host
The outside request shows one moment. The host shows the cause. Look at the value of OLLAMA_HOST, at any published container port, and at the firewall or cloud security-group rules that mention the port. For Open WebUI, read ENABLE_SIGNUP and DEFAULT_USER_ROLE. The Open WebUI reference lists sign-up as true by default and the default role as pending.
4. Check what the app itself ships
List your EXPO_PUBLIC_ variables. A model host address, an AI provider key or a workflow-tool token in that list is a finding whatever the outside request showed. Our 15-minute app check covers the rest of the bundle.
What does each result mean?
| What came back from outside | State | Next step |
|---|---|---|
| The software answered with no sign-in | Detected | Close it first, then rotate what the host could read |
| A sign-in page or a 401 / 403 | Unknown | Check sign-up settings, default role and version; the gate exists but its strength is unproven |
| Refused connection or timeout | Unknown | Read the bind setting and firewall rules; a timeout can also mean you tested the wrong port or host |
| Localhost bind, no forwarding rule, and a failed outside request | Confirmed by owner evidence | Keep the settings and the dated note; repeat after any change to the host |
No outside check, ours or anyone's, moves a server from unknown to confirmed. Only the host's own settings and your dated notes do. A server that answered on one day can be closed the next, so write the date on every result.
How do I close the exposure?
The Cloud Security Alliance note lists three steps: bind unprotected instances to localhost or a private network, or put them behind an authenticated reverse proxy; audit credential handling and rotate leaked tokens; and run periodic external attack-surface checks. Applied to an app:
- Remove
OLLAMA_HOSToverrides that bind to all interfaces unless a proxy with sign-in and TLS sits in front. - Have the app call your own server. That server checks who is asking, limits requests per user and holds the only copy of any provider key. If the model sits behind MCP over HTTP, the MCP authorization spec says servers must validate that tokens were issued for them.
- Turn off Open WebUI sign-up if you do not need it, keep the default role at pending, and update past the CVE-2026-87017 range (0.7.0 to 0.11.0, fixed in 0.11.1).
- Move any key out of
EXPO_PUBLIC_variables, then rotate it. Our guide to rotating LLM provider keys and the Red guide on rotating secrets after a breach walk through the order. - Give agent tools the least access that works. The CISA joint guide says to avoid broad or unrestricted access, and the OWASP LLM list names excessive agency and unbounded consumption as separate risks.
If your app also has a chat feature on a hosted AI provider, the chatbot self-test covers the key and the bill. If the host also serves a website, bots probing for secret files on that site follow a similar pattern; the Red page on bots requesting .env and .git shows the 30-second version.
Where do you stand?
Everything starts as unknown. Move an item to confirmed only when you hold the evidence listed under it.
Your exposed-endpoint check
- Detected: You found the problem.
- Unknown: Not checked yet, or the check could not tell.
- Confirmed by owner evidence: You checked and kept the proof.
Your answers stay in this browser tab. Nothing is saved or sent.
Frequently asked questions
Does Ollama have a password or API key?
The Ollama FAQ and API reference describe no authentication mechanism, and a 2026 measurement study states that it ships its REST API on port 11434 without built-in authentication. Anything you want in front of it, such as sign-in, TLS and rate limits, you add yourself with a reverse proxy or by keeping it on a private network.
Can I test from my laptop on the same Wi-Fi?
That test is weak, because your router or host may let local traffic through that it blocks from outside. Use your phone on mobile data with Wi-Fi switched off, or a machine on a different network, so the request arrives the way a stranger's would.
My Open WebUI shows a sign-in page. Am I fine?
A sign-in page closes the open door but leaves two questions. Is sign-up still switched on with a role that lets new accounts in, and is the version current? The Open WebUI docs list ENABLE_SIGNUP as true by default, and the September 2026 advisory CVE-2026-87017 affects versions 0.7.0 to 0.11.0 and is fixed in 0.11.1.
Does the free scan on red.run.cloud look at this?
Red works from a domain you prove you own with a DNS TXT record. Its free scan lists databases, services, panels and consoles that answer on that domain. A model server on a bare IP address, or on a hostname you did not add, is outside what it reads, so do the manual check above for those.
What do I rotate if the endpoint was open?
Anything the machine or the tools on it could read: provider API keys, tokens stored in workflow tools such as n8n or Flowise, and database passwords. The Cloud Security Alliance note advises auditing credential handling in workflows and rotating leaked tokens. Create the new key, switch your app to it, then revoke the old one.
I only call a hosted AI provider from my app. Does this apply?
Not to the provider's servers, which you do not run. It applies if you also run a model server, a chat interface or an agent platform of your own, for yourself or for a client. For the hosted-provider side, the risk is the key and the bill, covered in the chatbot self-test linked in this article.
Sources
All sources opened on October 24, 2026.
- 36,769 Exposed AI Endpoints: A Self-Hosted Supply Chain Crisis, Cloud Security Alliance Labs, September 15, 2026
- Ollama FAQ: how do I expose Ollama on my network?, Ollama docs
- Ollama API reference, Ollama on GitHub
- Ollama in the Wild: a measurement study (arXiv 2609.07115), arXiv
- Silent Brothers: Ollama hosts form an anonymous AI network, SentinelOne Labs
- Open WebUI environment variable reference, Open WebUI docs
- CVE-2026-87017, Open WebUI knowledge search access control, GitLab Advisory Database
- Environment variables in Expo, Expo docs
- MCP specification 2026-07-28: Authorization, modelcontextprotocol.io
- Joint guide on adopting agentic AI, May 1, 2026, CISA
- OWASP Top 10 for LLM Applications (2025 list), OWASP GenAI Security Project
- Security incident, October 21, 2026, LiteLLM