HIGH LM Studio: LM Studio local API reachable without authentication
Why it matters
LM Studio's OpenAI-compatible API is meant for localhost. On the public internet, strangers can list and run your local models on your hardware.
Fix it — 3 steps
- Disable network binding in LM Studio (listen on 127.0.0.1 only).
- If you need remote access, put an authenticating reverse proxy with TLS in front.
- Block the port at the firewall: `sudo ufw deny 1234`.
Verify it’s fixed
curl -m 5 http://YOUR_SERVER_IP:1234/v1/models # should time out or refuse from outside
References
Not sure if your stack is exposed?
Run the free check — 30 seconds, safe read-only probes.
Scan your stack