175,000 Exposed Ollama Hosts Enabling LLM Abuse — Threadlinqs Intelligence
As of 2026-05-30, 175,000 Exposed Ollama Hosts Enabling LLM Abuse is a medium-severity misconfiguration threat attributed to a Multiple-nexus actor, tracked by Threadlinqs Intelligence with 16 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 49 indicators of compromise.
Threat ID: TL-2026-0020 · Severity: MEDIUM · CVSS: 6.5 · Status: ACTIVE · Category: MISCONFIGURATION
Attribution: Multiple · FINANCIAL
175,000+ Ollama AI inference servers are exposed to the internet without authentication, creating the largest known mass-exploitable AI infrastructure surface in history. Ollama — the most popular
Ollama is a platform that simplifies running large language models locally, inspired by Docker's container model for AI. With 162K+ GitHub stars and widespread adoption in development, research, and production AI pipelines, it has become the de facto standard for self-hosted LLM inference. The critical security problem: Ollama has NO built-in authentication mechanism. The API server exposes endpoints that provide full control over the instance — model management, inference, file operations — to anyone who can reach port 11434.
The mass exposure problem is architectural:
1. DEFAULT DOCKER BINDING: Ollama's Docker image (ollama/ollama) binds to 0.0.0.0:11434 by default. Every Docker deployment without explicit network configuration exposes the API to all interfaces. Docker's default networking maps container ports to 0.0.0.0 on the host, meaning a simple 'docker run -p 11434:11434 ollama/ollama' exposes the instance to the entire internet if the host has a public IP.
2. NO AUTHENTICATION: Ollama provides zero authentication capability. There is no username/password, no API key, no token system, no OAuth. The project recommends deploying behind a reverse proxy with authentication — but this is not the default and most users don't configure it. Ollama's own GitHub issues (#849) document the feature request for built-in auth, which remains unimplemented.
3. SCANNING DISCOVERY: Criminal groups use Shodan, Censys, and custom scanners to enumerate port 11434 across the internet. A simple Shodan query 'port:11434' returns 175,000+ results. Each result is a fully accessible Ollama instance. The scanning → exploitation pipeline is automated: enumerate hosts → check /api/tags for available models → assess GPU capability → monetize via compute theft or model theft.
4. API ABUSE SURFACE: Exposed Ollama APIs enable complete control:
- /api/generate — Run inference on any available model (compute theft)
- /api/chat — Interactive chat sessions consuming GPU compute
- /api/pull — Download models from the instance (model theft)
- /api/push — Push models to external registries
- /api/delete — Delete models (denial of service/data destruction)
- /api/create — Create custom models from Modelfiles
- /api/tags — Enumerate all available models (reconnaissance)
- /api/show — Show model details including parameters and license
5. CVE-2024-37032 (PROBLLAMA): Discovered by Wiz Research, this path traversal vulnerability in Ollama's /api/pull endpoint allows arbitrary file write on the server. In Docker deployments (which run as root), exploitation chain: malicious manifest → path traversal in digest field → write to /etc/ld.so.preload → shared library loaded on next process creation → root RCE. Patched in Ollama 0.1.34 but many exposed instances remain unpatched.
Comparison to MongoDB/Elasticsearch mass exposure (2017-2020):
- MongoDB (2017): ~68,000 exposed instances → ransom attacks → $1,000 demands
- Elasticsearch (2019): ~36,000 exposed instances → data theft → identity fraud
- Ollama (2024-2026): 175,000+ exposed instances → compute theft → $46K-$100K+/DAY
The pattern is identical: popular infrastructure software with no authentication by default, deployed by developers who don't configure network security, discovered via internet scanning, and exploited at scale. But the economics are fundamentally different: database ransom was a one-time $1K demand per instance; LLMjacking generates $46K/day in ongoing compute theft per compromised cloud account. The financial incentive for attackers is 1,000-100,000x higher.
Sysdig TRT documented the OAI Reverse Proxy ecosystem: stolen LLM access is monetized via reverse proxy infrastructure that sells access to multiple compromised accounts. Users pay for access; attackers manage pools of stolen credentials. Prices: $30 for 30-day access tokens. The proxy checks if logging is enabled and refuses to use credentials with CloudTrail logging — OPSEC-aware criminal infrastructure.
Ge
Weaknesses (CWE)
CWE-284, CWE-306
Target sectors: Information Technology, Research and Development, Financial Services, Healthcare, Education, Government, Cloud Service Providers
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 16 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 49 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MISCONFIGURATION, MEDIUM, threat intelligence, cybersecurity, T1190, T1583.004, T1496, T1595, T1596, T1078, T1203, T1059, T1574, T1068