175,000 Exposed Ollama Hosts Enabling LLM Abuse
175,000 Exposed Ollama Hosts Enabling LLM Abuse (TL-2026-0020), also tracked as Ollama Exposure, is a medium-severity misconfiguration threat scored CVSS 6.5, first published 2026-02-02. It has no confirmed attribution, affects Ollama Ollama, maps to 30 MITRE ATT&CK techniques (T1036, T1046, T1059), and is covered by 16 detection rules and 49 indicators of compromise.
Key facts for TL-2026-0020
- Threat ID
- TL-2026-0020
- Also known as
- Ollama Exposure, LLM Abuse, AI Infrastructure Misconfiguration
- Severity
- MEDIUM
- CVSS
- 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- Status
- ACTIVE
- Category
- MISCONFIGURATION
- First published
- 2026-02-02
- Last reviewed
- 2026-02-02
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- Information Technology, Research and Development, Financial Services, Healthcare, Education, Government, Cloud Service Providers
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 16
- Indicators of compromise
- 49
175,000+ Ollama AI inference servers are exposed to the internet without authentication, creating the largest known mass-exploitable AI infrastructure surface in history. Ollama — the most popular open-source project for running AI models (162K+ GitHub stars, hundreds of thousands of monthly Docker Hub pulls) — has NO built-in authentication. Its default Docker deployment binds to 0.0.0.0:11434, exposing the full API to the internet. Automated scanning by criminal groups discovers these instances via Shodan/Censys port 11434 enumeration, enabling: (1) LLMjacking — compute theft at $46K-$100K+/day per compromised cloud account via AWS Bedrock/Anthropic API abuse, (2) Model theft — downloading proprietary fine-tuned models via /api/pull, (3) Remote code execution — CVE-2024-37032 (Probllama) path traversal → ld.so.preload hijack → root RCE on Docker instances, (4) GPU cryptomining pivot — repurposing GPU-rich LLM hosts for cryptocurrency mining, (5) Data exfiltration — accessing training data and conversation logs stored on exposed instances. This is the MongoDB/Elasticsearch exposure pattern (2017-2020) repeating in the AI era: massively deployed infrastructure with no authentication by default, discoverable via internet scanning, and exploited at scale within months. The economics are orders of magnitude worse: MongoDB ransom demanded $1,000; LLMjacking generates $46K/DAY. Wiz Research discovered 1,000+ instances with exposed private models in their initial scan. Sysdig TRT documented OAI Reverse Proxy monetization infrastructure selling stolen LLM access. The scanning → exploitation pipeline is fully automated: port 11434 scan → /api/tags to enumerate models → /api/generate for compute theft → /api/pull for model theft → Probllama RCE for persistent access.
How 175,000 Exposed Ollama Hosts Enabling LLM Abuse works
Ollama is a platform that simplifies running large language models locally, inspired by Docker's container model for AI. With 162K+ GitHub stars and widespread adoption in development, research, and production AI pipelines, it has become the de facto standard for self-hosted LLM inference. The critical security problem: Ollama has NO built-in authentication mechanism. The API server exposes endpoints that provide full control over the instance — model management, inference, file operations — to anyone who can reach port 11434.
The mass exposure problem is architectural:
1. DEFAULT DOCKER BINDING: Ollama's Docker image (ollama/ollama) binds to 0.0.0.0:11434 by default. Every Docker deployment without explicit network configuration exposes the API to all interfaces. Docker's default networking maps container ports to 0.0.0.0 on the host, meaning a simple 'docker run -p 11434:11434 ollama/ollama' exposes the instance to the entire internet if the host has a public IP.
2. NO AUTHENTICATION: Ollama provides zero authentication capability. There is no username/password, no API key, no token system, no OAuth. The project recommends deploying behind a reverse proxy with authentication — but this is not the default and most users don't configure it. Ollama's own GitHub issues (#849) document the feature request for built-in auth, which remains unimplemented.
3. SCANNING DISCOVERY: Criminal groups use Shodan, Censys, and custom scanners to enumerate port 11434 across the internet. A simple Shodan query 'port:11434' returns 175,000+ results. Each result is a fully accessible Ollama instance. The scanning → exploitation pipeline is automated: enumerate hosts → check /api/tags for available models → assess GPU capability → monetize via compute theft or model theft.
4. API ABUSE SURFACE: Exposed Ollama APIs enable complete control: - /api/generate — Run inference on any available model (compute theft) - /api/chat — Interactive chat sessions consuming GPU compute - /api/pull — Download models from the instance (model theft) - /api/push — Push models to external registries - /api/delete — Delete models (denial of service/data destruction) - /api/create — Create custom models from Modelfiles - /api/tags — Enumerate all available models (reconnaissance) - /api/show — Show model details including parameters and license
5. CVE-2024-37032 (PROBLLAMA): Discovered by Wiz Research, this path traversal vulnerability in Ollama's /api/pull endpoint allows arbitrary file write on the server. In Docker deployments (which run as root), exploitation chain: malicious manifest → path traversal in digest field → write to /etc/ld.so.preload → shared library loaded on next process creation → root RCE. Patched in Ollama 0.1.34 but many exposed instances remain unpatched.
Comparison to MongoDB/Elasticsearch mass exposure (2017-2020): - MongoDB (2017): ~68,000 exposed instances → ransom attacks → $1,000 demands - Elasticsearch (2019): ~36,000 exposed instances → data theft → identity fraud - Ollama (2024-2026): 175,000+ exposed instances → compute theft → $46K-$100K+/DAY
The pattern is identical: popular infrastructure software with no authentication by default, deployed by developers who don't configure network security, discovered via internet scanning, and exploited at scale. But the economics are fundamentally different: database ransom was a one-time $1K demand per instance; LLMjacking generates $46K/day in ongoing compute theft per compromised cloud account. The financial incentive for attackers is 1,000-100,000x higher.
Sysdig TRT documented the OAI Reverse Proxy ecosystem: stolen LLM access is monetized via reverse proxy infrastructure that sells access to multiple compromised accounts. Users pay for access; attackers manage pools of stolen credentials. Prices: $30 for 30-day access tokens. The proxy checks if logging is enabled and refuses to use credentials with CloudTrail logging — OPSEC-aware criminal infrastructure.
Geographic distribution: exposed Ollama instances span AWS, GCP, Azure, DigitalOcean, Hetzner, OVH, and on-premises networks. Cloud deployments are highest risk because the underlying cloud accounts have IAM roles that may provide access to additional cloud services (Bedrock, Vertex AI, SageMaker). Compromising an Ollama instance on a cloud VM is often the entry point to broader cloud account compromise.
MITRE ATT&CK techniques used in TL-2026-0020
defense-evasion
T1036 Masquerading; T1078 Valid Accounts
discovery
T1046 Network Service Discovery; T1082 System Information Discovery; T1580 Cloud Infrastructure Discovery
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
privilege-escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
persistence
T1133 External Remote Services; T1136 Create Account
initial-access
T1190 Exploit Public-Facing Application
lateral-movement
T1210 Exploitation of Remote Services
collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
impact
T1485 Data Destruction; T1489 Service Stop; T1496 Resource Hijacking; T1657 Financial Theft
credential-access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
exfiltration
T1567 Exfiltration Over Web Service
stealth
resource-development
T1583 Acquire Infrastructure; T1583.004 Server; T1588 Obtain Capabilities
reconnaissance
T1590 Gather Victim Network Information; T1595 Active Scanning; T1596 Search Open Technical Databases
defense-impairment
Affected products and versions in 175,000 Exposed Ollama Hosts Enabling LLM Abuse
- Ollama — Ollama
Vulnerable versions: All versions with network exposure
Remediation for 175,000 Exposed Ollama Hosts Enabling LLM Abuse
Immediate actions
- Audit all Ollama deployments for network exposure
- Bind Ollama to localhost only (default) unless remote access required
- Implement firewall rules to restrict port 11434 access
- Check for unauthorized model pulls or API usage
Workarounds
- Set OLLAMA_HOST=127.0.0.1 environment variable
- Use SSH tunneling for remote Ollama access
- Deploy in container with proper network isolation
Longer-term hardening
- Deploy Ollama behind reverse proxy with authentication
- Implement API key authentication if remote access needed
- Monitor Ollama resource usage for anomalies
- Use network segmentation for AI/ML infrastructure
Weaknesses (CWE) in 175,000 Exposed Ollama Hosts Enabling LLM Abuse
CWE-284, CWE-306
Timeline of 175,000 Exposed Ollama Hosts Enabling LLM Abuse
- MongoDB mass exposure begins — 68,000+ internet-accessible MongoDB instances without authentication discovered via Shodan. Ransom attacks demand $1,000 per database. The pattern: popular infrastructure, no auth by default, mass internet exposure, automated exploitation. Ollama will repeat this pattern with 100-1000x worse economics. Source: BleepingComputer
- Ollama GitHub Issue #849 opened requesting built-in authentication support. Community recognizes the risk of exposing Ollama without auth. Ollama team recommends reverse proxy as workaround. Feature remains unimplemented through 2026. Source: https://github.com/ollama/ollama/issues/849
- Ollama gains significant traction as the simplest way to run AI models locally. Docker image ollama/ollama published with default 0.0.0.0 binding. No authentication mechanism available. GitHub stars rapidly climb. Developers deploy without security configuration. Source: GitHub ollama/ollama
- Wiz Research discovers CVE-2024-37032 (Probllama) — path traversal in Ollama /api/pull endpoint. Digest field in manifest used without validation → arbitrary file write → ld.so.preload hijack → root RCE on Docker instances. Ollama commits fix within 4 hours of disclosure. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
- Sysdig TRT publishes LLMjacking research — stolen cloud credentials used to abuse hosted LLM services at $46K-$100K+/day. OAI Reverse Proxy monetization infrastructure identified. Keychecker tool validates credentials across 10 AI services. Attackers check and avoid accounts with CloudTrail logging enabled. Source: https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
- Ollama releases version 0.1.34 patching CVE-2024-37032. Fix addresses path traversal in digest field validation. However, authentication is still not added — patched instances remain fully accessible without auth if internet-exposed. Source: Ollama releases
- Wiz Research internet scan reveals 1,000+ exposed Ollama instances with private AI models not listed in public Ollama registry. Many running vulnerable versions pre-0.1.34. Private/proprietary fine-tuned models accessible to any attacker. Source: Wiz Research Probllama blog
- Wiz Research publishes full Probllama technical writeup. Details exploitation chain: malicious manifest → path traversal → /etc/ld.so.preload → shared library preload → root RCE. Notes Docker deployments run as root by default. Recommends never exposing Ollama to internet without authentication. Source: https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
- Sysdig TRT publishes LLMjacking update — attack volume increasing. 2.2 billion tokens consumed on single OAI Reverse Proxy instance. DeepSeek-R1 adopted by LLMjackers within 24 hours of release. Drago scripts for automated credential validation. 4chan/Discord coordination for stolen credential trading. Source: Sysdig TRT
- Shodan port 11434 enumeration reveals 175,000+ exposed Ollama instances globally. Dramatic increase from Wiz's 1,000+ count in June 2024. Exponential adoption of Ollama combined with persistent 0.0.0.0 default binding drives exposure growth. Each instance is fully accessible without authentication. Source: Shodan
- Sysdig TRT documents LLMjackers adopting DeepSeek-R1 within 24 hours of release. LLMjacking ecosystem evolves faster than legitimate AI adoption. Criminal groups track new model releases to exploit them immediately on compromised infrastructure. Source: Sysdig TRT DeepSeek blog
- Broader AI inference server vulnerability landscape: TorchServe RCE, Ray Anyscale (ShadowRay — actively exploited), Ollama (Probllama), Hugging Face infrastructure risks, Replicate vulnerabilities. Common theme: AI tools lack authentication by design, developers expose them to internet, attackers automate exploitation at scale. Source: Wiz, Oligo Security, Sysdig
- Current state: 175,000+ exposed Ollama instances. No built-in auth. CVE-2024-37032 patched but many unpatched instances remain. LLMjacking generates $46K-$100K+/day per compromised cloud account. OAI Reverse Proxy sells stolen access at $30/30 days. Ollama reaches 162K+ GitHub stars. The MongoDB pattern repeats with 1,000-100,000x worse financial impact.
- As of 2026-05-29, TL-2026-0020 remains ACTIVE: SentinelLABS+Censys confirmed 175,000 exposed Ollama hosts (TheHackerNews, Jan 29 2026) and the attributed LLMjacking campaign "Operation Bizarre Bazaar" (actor Hecker, silver[.]inc marketplace) is ongoing with 35,000+ sessions. Ollama still ships no native auth, no takedown reported, and the misconfiguration surface persists unremediated.
Sources cited for 175,000 Exposed Ollama Hosts Enabling LLM Abuse
- Wiz Research — Probllama: Ollama RCE (CVE-2024-37032)
- Sysdig TRT — LLMjacking: Stolen Cloud Credentials
- Ollama GitHub Repository
- Ollama Docker Hub
- Ollama API Documentation
- NVD — CVE-2024-37032
- OAI Reverse Proxy Source
- Kingbased/keychecker — LLM Credential Validator
- AWS Bedrock Pricing
- Wiz — State of AI in the Cloud 2024
- Oligo Security — ShadowRay (Ray Anyscale)
- Wiz — Hugging Face AI Infrastructure Risks
- Wiz — Replicate AI Vulnerability
- Shodan — Port 11434 Search
- Ollama GitHub Issue #849 — Auth Request
Threats related to 175,000 Exposed Ollama Hosts Enabling LLM Abuse
Detection coverage for TL-2026-0020
As of 2026-02-02, Threadlinqs Intelligence publishes 16 detection rule(s) for TL-2026-0020 across Splunk SPL, Microsoft KQL and Sigma, covering 49 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.