Most recent
navigate open esc close Corpus index built 2026-06-07 23:58 UTC

§ THE STACK / APPLICATION LAYER

Chat UIs

Open WebUI, ChatGPT-style frontends

The surfaces humans actually interact with: chat UIs, notebooks, generation studios.

What it is

Open WebUI (formerly Ollama WebUI) is the most popular self-hosted chat interface for local LLMs. It looks like ChatGPT, talks to Ollama or any OpenAI-compatible backend, supports multi-user accounts, RAG document upload, and has become the de-facto control panel for self-hosted AI. LibreChat, Chatbot UI, and a handful of others share the niche.

What goes wrong

Open WebUI ships with open registration enabled by default: visit the URL, click “Sign up”, you’re inside. The first user is silently promoted to administrator, and admin accounts can read every other user’s chat history, upload arbitrary RAG documents into the shared knowledge base, and route prompts through any configured backend at the operator’s expense. When the operator never bothers to disable signups (and very few do), anyone who finds the IP becomes a peer user with full access to the whole multi-tenant shared corpus.

How we test

We confirm Open WebUI by its /manifest.json and the very specific bundle hash of its frontend, then test the registration endpoint with a benign account creation. We do not enumerate other users’ chats; the proof of exposure is the successful account itself, which we screenshot and report. Where the deployment connects to a backend gateway (LiteLLM, OneAPI), we note which provider’s API key the operator is paying for. That’s the quota-drain story that makes the disclosure land.

Receipts

Research

Every survey, case study, and disclosure we've published that touches this layer of the stack. Counts on the cells above tally these directly.

Cross-cloud surveys

6
Survey Jun 6, 2026

LibreChat Population Survey — 412/1,565 Open Registration (26.3%)

LibreChat (github.com/danny-avila/LibreChat) is an open-source ChatGPT-alternative chat interface — supports multiple LLM providers, plugins, multimodal, multi-tenant via shared deployments. 3,153 Sho…

Read →
Survey Jun 6, 2026

LobeChat Population Survey — 10/12 Fully Open (83.3%, small population)

LobeChat (github.com/lobehub/lobe-chat) is an open-source ChatGPT-alternative chat interface from Lobehub, a China-origin OSS community. Direct functional parallel to LibreChat. 641 Shodan-indexed; 63…

Read →
Survey Jun 6, 2026

Open WebUI Population Survey — 39 Auth-Off, 564 Open Signup

18,389 Shodan-indexed instances of Open WebUI. One GET to /api/config returns a JSON object that tells you everything: whether auth is enforced, whether public registration is open, the operator's bra…

Read →
Survey Jun 6, 2026

Cat-OW Calibration Deltas — 5 Named Findings Re-Verified

A spot-check verification pass on five named-institution findings in the Open WebUI population survey, applying the attribution hierarchy from Insight #79.

Read →
Survey Jun 5, 2026

Cat-03 Model Serving & Inference — Survey 2026-06-05

Survey of 5,018 IPs across 17 Shodan and 9 Censys queries targeting Cat-03 (model serving and inference: llama.cpp, KoboldCpp, LM Studio, vLLM, SillyTavern, faster-whisper, One API, New API, Open WebU…

Read →
Survey May 3, 2026

Open WebUI on Public Cloud: Auth Posture Survey

Reused the 20,581 port-3000 hits from the prior Flowise sweep and re-fingerprinted them for Open WebUI (the popular Ollama / OpenAI-compatible chat frontend) via GET /api/version body match ({"version…

Read →

Field cases

17
Case Jun 6, 2026

LibreChat Verification Deep-Dive — Notable Findings Re-Profiled

Deeper verification on the six notable finding clusters surfaced in the LibreChat population survey. Restraint maintained throughout: no registration, no LLM invocation, no account creation. Methods u…

Read →
Case May 19, 2026

University of Arizona: Branded "U of A GenAI" — Open WebUI v0.7.2 with University-OIDC + Auth-On

The University of Arizona operates a branded institutional Open WebUI service at genai.arizona.edu (128.196.254.101). The deployment is reachable on port 80 (reverse-proxied; Open WebUI's typical :300…

Read →
Case May 19, 2026

UCLA: Multi-Service AI Stack on `ai.idre.ucla.edu` — Open WebUI Signup-Open + LDAP + LiteLLM Dual-Exposed

UCLA's Institute for Digital Research and Education (IDRE) runs a multi-service LLM stack at ai.idre.ucla.edu (128.97.60.220, Los Angeles). Three distinct services on three ports: Open WebUI v0.9.1 on…

Read →
Case May 19, 2026

Red Rocks Community College: Open WebUI v0.9.2 on `datalab02.rrcc.edu` — Auth-On + LDAP (First Community College in Survey)

Red Rocks Community College runs an Open WebUI instance at datalab02.rrcc.edu (164.47.99.16:8080). /api/config returned Open WebUI v0.9.2 with enablesignup: false (auth-on; no signup-open class) and e…

Read →
Case May 19, 2026

DePaul University: Campus-Wide Port-3000 Population — Live Open WebUI Auth-On, DHCP-Rotated Hosts, Mixed Student Dev Work

DePaul's institutional network surfaces 20+ hosts with port 3000 open when scoped via Shodan org:"DePaul University". Only 4 of these have HTTP title "Open WebUI"; the rest are student dev servers (Re…

Read →
Case May 19, 2026

University of Maryland College Park: Open WebUI v0.3.32 on `amorgos.umd.edu` — `enable_signup:true` OBSERVED on Very-Old Version

University of Maryland College Park runs an Open WebUI instance at amorgos.umd.edu (128.8.235.4, Brookeville MD). /api/config returned enablesignup: true on Open WebUI v0.3.32 — class membership for s…

Read →
Case May 19, 2026

Cooper Union for the Advancement of Science and Art: Open WebUI v0.9.2 on `kahan.ee.cooper.edu` — Auth-On + LDAP

Cooper Union runs an Open WebUI instance at kahan.ee.cooper.edu (199.98.27.237). /api/config returned Open WebUI v0.9.2 with enablesignup: false (auth-on; no signup-open class) and enableldap: true (L…

Read →
Case May 19, 2026

Cornell University: Open WebUI v0.6.14 on `onepl.aap.cornell.edu` — Auth-On + API Keys Enabled

Cornell University runs an Open WebUI instance at onepl.aap.cornell.edu (128.253.41.30:3000). /api/config returned Open WebUI v0.6.14 with enablesignup: false (auth-on; no signup-open class) and enabl…

Read →
Case May 3, 2026

University of Indonesia: Unauthenticated Ollama Node

The University of Indonesia (Universitas Indonesia, UI) exposes one Ollama node at 152.118.31.61 (Depok, West Java, AS3382). The instance runs an ancient Ollama build (v0.5.4-dirty) and hosts llama3.2…

Read →
Case May 1, 2026

hts.k12.nj.us: NJ K-12 Open WebUI + Ollama Exposure

A New Jersey K-12 school district server running Open WebUI v0.8.8 backed by Ollama v0.17.5 was found with the raw Ollama API port (11434) exposed to the public internet alongside the authenticated Op…

Read →
Case May 1, 2026

Keio University: Unauthenticated Ollama, Dual Cloud Proxy, 122B Model

Keio University (Japan) server with 8 Ollama models including two DeepSeek cloud proxy subscriptions and a 122-billion-parameter Qwen3.5 MoE model. Raw Ollama port publicly accessible without authenti…

Read →
Case May 1, 2026

Thailand Ministry of Public Health: Unauthenticated Inference, Vision Models

Thailand's Ministry of Public Health (MoPH) has an Ollama instance at 203.157.41.151 with 5 models publicly accessible, including granite3.2-vision:2b (IBM's vision-language model) and qwen3.6:35b (22…

Read →
Case May 1, 2026

UC Santa Barbara: Open WebUI Auth Disabled + Local Username Leak

University of California, Santa Barbara "AI Lab" instance running Open WebUI v0.8.12 with authentication completely disabled. Any internet actor can enumerate models, read model configurations, and ex…

Read →
Case May 1, 2026

Purdue University Northwest: 3-Node Cluster, Account Takeover, Live Cloud Proxies, Claude-Distilled Model

Purdue University Northwest has 3 nodes across the 163.245.x.x subnet, all with cloud proxy subscriptions. Node 2 (163.245.207.105) exposes live Ollama Connect credentials, account takeover 5a9d376f9c…

Read →
Case May 1, 2026

Columbia University: Unauthenticated Ollama + Cloud Proxy Credential Leak

Columbia University server running Open WebUI v0.8.12 (auth enabled) with raw Ollama API (port 11434) exposed to the public internet. One active cloud proxy subscription (DeepSeek) accessible without…

Read →
Case May 1, 2026

Syracuse University: IST R640 Server, Free-Tier Cloud Proxy on Port 12345

A Dell PowerEdge R640 server in Syracuse University's School of Information Studies (ist-r640-mafudge.syr.edu) is running Ollama on non-standard port 12345 with gemma4:31b-cloud returning 200 OK witho…

Read →
Case May 1, 2026

Virginia Polytechnic Institute and State University (Virginia Tech): DHCP Node

Virginia Tech has at least 4 Ollama-running IPs in Shodan; only h80adf308.dhcp.vt.edu (128.173.243.8) responds publicly. The DHCP hostname indicates a desktop or workstation on the campus DHCP pool ra…

Read →