The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet
Researchers counted 36,769 publicly reachable self-hosted AI endpoints, only about 2% behind HTTP authentication, exposing Ollama, vLLM, and Flowise to abuse.
A Mysterium VPN study found 36,769 self-hosted AI endpoints reachable through internet scanning, with only 2.02% returning an HTTP authentication challenge. Open WebUI accounted for 18,529 reachable instances, Ollama for 6,935 fingerprinted hosts, and 5,223 agent-builder and workflow platforms were exposed, often holding API keys, database credentials, and other secrets. The report highlights LLMjacking risk from exposed Ollama APIs, a critical Flowise bug (CVE-2026-40933), leaked n8n tokens, and prior SentinelOne/Censys research finding roughly 175,000 exposed Ollama hosts in 130 countries.
- 36,769 exposed self-hosted AI endpoints found; only 2.02% returned an HTTP authentication challenge.
- Open WebUI: 18,529 instances, one authenticated; Ollama: 6,935 hosts, 6,046 responding anonymously.
- 5,223 agent-builder and workflow platforms exposed, often storing API keys, database and CRM credentials.
- GitGuardian found 4,576 leaked n8n tokens; 321 of 896 reachable instances accepted a leaked token.
- CVE-2026-40933: critical Flowise MCP-adapter command execution, fixed in version 3.1.0.
- CVEs
- CVE-2026-40933
- Organizations
- Mysterium VPNGitGuardianSentinelOneCensys
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-40933 | Flowise: Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an… | 9.9 | 12% | PoC |
From the original article
6 min read at securityaffairs.com
Researchers found 36,769 exposed AI endpoints, but only 2% had an HTTP authentication gate. Running AI locally is supposed to give organizations more control. Models, prompts and documents stay on infrastructure they manage instead of being sent to a third-party cloud.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.