175K+ publicly-exposed Ollama AI instances discovered

Post by [deleted] » Sat, Jan 31, 2026, 1:38 AM UTC

crimsonnoodle58 wrote: post #9

chrisjj wrote: post #4

Earlier quoted context omitted.

The article says no, the default is listening to just localhost. Given the instances in question have been deliberately configured to listen on public ports, calling this misconfiguration seems somewhat unjustified.

Not true for their docker instructions which specify -p 11434:11434 instead of -p 127.0.0.1:11434:11434. [1] Combine that with rootful docker's famous bypass of ufw and you have a publicly exposed ollama, even with a firewall. [2] [1] https://docs.ollama.com/docker [2] https://github.com/moby/moby/issues/4737

Post by throwaway314155 » Sat, Jan 31, 2026, 1:44 AM UTC

cyberax wrote: post #10

Fun fact! On macOS you can expose privileged ports ( But ONLY if you don't bind the listening port to any interface. So you try to create a listening port on localhost (e.g. 127.0.0.1:443) under a non-root account you get a permission error. Edit: the thing is, you CAN expose "0.0.0.0:443" without root privileges!

Post by vxxzy » Sat, Jan 31, 2026, 2:01 AM UTC

cyberax wrote: post #10

Fun fact! On macOS you can expose privileged ports ( But ONLY if you don't bind the listening port to any interface. So you try to create a listening port on localhost (e.g. 127.0.0.1:443) under a non-root account you get a permission error. Edit: the thing is, you CAN expose "0.0.0.0:443" without root privileges!

Post by kristopolous » Sat, Jan 31, 2026, 2:23 AM UTC

cyberax wrote: post #10

Fun fact! On macOS you can expose privileged ports ( But ONLY if you don't bind the listening port to any interface. So you try to create a listening port on localhost (e.g. 127.0.0.1:443) under a non-root account you get a permission error. Edit: the thing is, you CAN expose "0.0.0.0:443" without root privileges!

Post by meltyness » Sat, Jan 31, 2026, 2:27 AM UTC

crimsonnoodle58 wrote: post #14

meltyness wrote: post #6

This is a weakness of docker, a bit, I think. I was rigging this up, myself, and conciscious of the fact that basic docker is "all or none" for container port forwarding because it's for presenting network services, had to dig around with iptables so it'd be similar to binding on localhost. The use case https://github.com/meltyness/tax-pal The ollama container is fairly easy to deploy, and supports GPU inference thro…

Yes the binding interface can be specified, but the default for -p 11434:11434 is 0.0.0.0. IMO the default should be 127.0.0.1 and the user should have to explicitly bind to all via -p 0.0.0.0:11434:11434.