Ollama exposed: 175,000 AI servers open online
Ollama ships with no authentication because it was meant to listen on localhost. Set OLLAMA_HOST=0.0.0.0 to reach it remotely and its REST API on port 11434 answers the whole internet with no login. Researchers scanning with Shodan have found anywhere from thousands to 175,000+ exposed Ollama servers — good for free inference on your GPU, model theft or deletion, and remote code execution on unpatched builds. Veil doesn't add a login to Ollama; it removes the internet exposure that makes the missing login matter.
Frequently asked questions
Is it safe to expose Ollama on 0.0.0.0?
No. Binding Ollama to 0.0.0.0 publishes its REST API on port 11434 to every interface with no authentication. Anyone who scans the port can run inference on your hardware, delete or tamper with your models, and exploit unpatched API/RCE flaws. Keep it on localhost or cloak it.
Does Veil add authentication to Ollama?
No — it removes the need by removing the exposure. With Veil the Ollama API is reachable only by devices you enrolled, so an unauthenticated server can't be found or abused by a scanner. Keep Ollama patched for its own client- and API-side CVEs.
How do I let my apps use a shared Ollama server safely?
Run Ollama on an internal host, cloak the API with Veil, and issue a member for each app, laptop or teammate that calls it. They reach the model over a verified identity, with nothing answering on port 11434 for a scanner to find.
Sources: Cisco — detecting exposed LLM servers (Ollama, Shodan) · TechRadar — 175,000+ exposed Ollama servers