vLLM / OpenAI-Compatible LLM Inference Servers on Public Cloud: Auth Posture Survey

NuClide Research · 2026-05-03

Summary

Reused the 22,765 port-8000 hits from the prior ChromaDB sweep and fingerprinted them for OpenAI-compatible LLM inference servers via GET /v1/models body match ({"object":"list","data":[{"object":"model",...}]}). 44 confirmed instances, all unauthenticated. Of these, 19 are confirmed vLLM (via /version returning a vLLM version string); the remaining 25 are generic OpenAI-compatible servers, a mix of vLLM-with-/version-disabled, llama.cpp-server, text-generation-inference, LM Studio, FastChat, and most concerningly commercial-API reseller proxies (operators standing up unauth gateways in front of paid OpenAI / Anthropic / xAI / Zhipu accounts).

DCWF KSAT coverage

Auto-derived from DCWF AI work-role rule files (ksat-tag).

• 672 (AI Test & Evaluation Specialist): K7003, K7004, K7044, S7068, S7070, S7075, T5904
• 733 (AI Risk & Ethics Specialist): K7051, S7067, T5868, T5893
• overlap (Common AI KSATs (all 5 roles)): K1158, K1159, K22, K6311, K6935, K7003, K942

Each unauth instance is a free LLM for anyone who finds it. For the reseller-proxy class, “free LLM” means direct quota theft from the operator’s paid commercial accounts: an attacker submits prompts, the proxy forwards to OpenAI/Anthropic/etc., the operator’s billing meter spins.

Methodology

Reused IPs from prior ChromaDB port-8000 masscan: 22,765 hosts

vllm-probe.py (200-thread fingerprint)
  GET /v1/models → match {"object":"list","data":[{"object":"model",...}]}
  GET /version    → if returns {"version":"x.y.z"}, classify as confirmed vLLM
  GET /metrics    → if contains "vllm:"-prefixed metrics, double-confirm vLLM
  → 44 confirmed (19 vLLM + 25 generic OpenAI-compat)

NuClide did not submit any prompt to /v1/chat/completions or /v1/completions. Inference would have used the operator’s compute (and for the reseller-proxy class, would have spent the operator’s commercial-API credits). The model-list endpoint and version probe alone are sufficient to prove exposure.

Findings Summary

Hosting

Threat Classes

The 44 instances split across four distinct threat classes:

Class A: Commercial-API reseller proxies (CRITICAL: direct billing theft)

These operators run an OpenAI-compatible gateway in front of paid accounts at OpenAI / Anthropic / xAI / Zhipu / etc. The gateway has no authentication on /v1/chat/completions, submitting a prompt routes through to the upstream commercial API, charging the operator’s account. An attacker can run unlimited inference using the operator’s commercial budget.

The proxy software (/openapi.json + /docs + /admin HTML) is fingerprintable:

Pattern: several of these are Chinese-origin open-source LLM proxy projects (Grok2API, Kiro-Go, AgentBar) deployed on cheap cloud VPSes by operators who want to re-package commercial APIs without authentication. The zh / zh-CN admin UIs and product naming confirm the origin community. This is a recognised abuse pattern in the broader AI-tooling underground, these proxies are typically pointed at shared/leaked commercial-API credentials and resold to users who cannot easily obtain foreign API keys directly.

Per-instance financial exposure: GPT-4o pricing ~$5/1M input + $15/1M output tokens; current xAI Grok pricing ~$3-15/1M tokens; Anthropic claude-sonnet-4.5 ~$3/1M input + $15/1M output. A motivated attacker can drain four-figure dollars per day per exposed proxy without rate limits in their way. The 126-model AgentBar proxy at 178.62.227.102 is the highest-value target in this class, it spans embeddings, audio, image, and multiple LLM families, suggesting sizeable quotas across vendors.

Admin UI exposure note: the admin pages render publicly (HTML layout, table headers like “API Key 列表 / API Key List”, login forms) but the data-API endpoints (/admin/api/keys, /admin/api/stats, /admin/api/users) return 401 on probes. The stored credentials are not directly leaked. However, the publicly visible product name + version enables CVE/default-credential lookup against the specific upstream project, and the /openapi.json discloses the full admin API surface for targeted exploitation if a default-credentials match exists.

Class B: Operator-attributed proprietary fine-tunes (HIGH: IP exposure)

The model name discloses the operator and their work. Each fine-tune is the product of expensive training runs on operator-curated data; the weights and behavior are now externally probeable.

Class C: Big-model production deployments (HIGH: compute theft scale)

These operators pay real money (multi-thousand-dollar GPU instances) to serve large models. Free LLM inference at this scale ties up GPU memory the operator paid for; sustained queries by an attacker degrade legitimate user experience.

Class D: Specialized / smaller deployments (MEDIUM)

Per-Class Severity

For Class A, the operator may not realize free credits are being burned until a billing alert fires, at which point thousands of dollars may already have been charged to their commercial API accounts.

Cross-Survey Pattern (updated)

The pattern is now overwhelming: every layer of the modern AI stack we have surveyed, vector DB, model-serving, LLM-inference proxy, ships with no authentication and most operators do not enable it.

Remediation

vLLM / vLLM-class servers

# Start vLLM with API key required
vllm serve <model> --api-key <strong-random-token>

# Or front it with an auth-enforcing reverse proxy:
# Caddy/Nginx with HTTP Basic auth or JWT validation in front of port 8000

Firewall port 8000 to the application backend’s CIDR.

Reseller-proxy class

These operators are running a thin OpenAI-API-compatible router in front of paid commercial accounts. Most such routers (LiteLLM, OpenRouter-self-host, OneAPI) support API-key auth via configuration; the operator has not enabled it. Enabling auth + rotating any compromised commercial-API credentials is the immediate fix; longer-term, putting the proxy behind a customer-facing gateway with per-customer rate-limiting is the architectural fix.

Disclosure Posture

The 10 Class-A reseller proxies are time-sensitive, every hour they remain open is more billable spend on the operator’s commercial-API accounts. Disclosure should target the operators directly via WHOIS / brand-domain pivots where possible, with DigitalOcean / Hetzner / Vultr abuse channels as fallback.

The 10 Class-B operator-attributed fine-tunes have identifiable upstream operators (sipgate, Infomaniak, Red Hat AI deployment customer), direct disclosure to those organizations’ security teams is the highest-bandwidth path.

NuClide is not opening 44 individual disclosure threads. Same-day priority is the Class-A reseller proxies (financial bleed) and the Class-B sipgate / Infomaniak findings (operator-attributable IP exposure).

NuClide Pipeline Artifacts

References

• vLLM authentication: https://docs.vllm.ai/en/latest/serving/openai_compatible_server.html#api-key
• OpenAI-compatible API spec: https://platform.openai.com/docs/api-reference
• Cross-survey index: index.md