6,935 exposed Ollama servers answered an internet scan without asking for credentials

Mysterium calls 36,769 a lower bound. The method explains why. The researchers treated an HTTP 401 or 403 as evidence of an authentication gate and refused to read a 200 as the opposite, because a login page returns 200 as readily as an open API does ^[5]. They queried Netlas, matched fingerprints against the responses and stopped there ^[7]. "We counted the doors. We didn't open them," the report said ^[6]. Nobody connected to a host, ran a model or read a credential, so nothing in this study shows that any of these endpoints was abused ^[7].

Ollama is the exception because of how it answers. Its root endpoint returns the string "Ollama is running" to a request carrying no credentials, so the fingerprint that identifies the service is also the proof that the service did not challenge the caller ^[11].

2.02% of 36,769 is about 743 endpoints with a gate in front of them ^[1]. Open WebUI supplied one of those, and vLLM's 4,880 endpoints supplied three ^[8][9], which leaves roughly 739 gated hosts somewhere other than the two largest populations in the study ^[3]. Open WebUI on its own is 50.4% of the census ^[7]. LocalAI's 150 instances and llama.cpp's 69 returned no challenge at all ^[10].

The workflow layer is where the credentials sit. Mysterium counted 1,341 reachable Flowise instances and not one HTTP authentication challenge among them ^[20]. The report also points at CVE-2026-40933, a critical Flowise flaw that lets an authenticated attacker run arbitrary commands through the MCP adapter, and which Flowise has fixed ^[21]. Authentication is a real precondition on an instance that asks for it, and costs the attacker nothing on an instance that never asks.

The exclusions are large. Mysterium recorded 22,024 responses on Ollama's default port 11434 and left all of them out of the total, because a port number does not prove which service is listening on it ^[17]. That excluded set is about 3.2 times the size of the Ollama population the report was willing to count ^[4].