FIX CARD
PRODUCT Open WebUI
SEVERITY HIGH
Open WebUI reachable from the internet
Why it matters
Your chat UI — including conversation history and any connected models — is reachable by anyone. If open signup is enabled, strangers can register their own accounts and use your models at your expense.
Fix it: 3 steps
- Disable open signup: Settings → Admin Settings → General → turn off 'Allow New Sign Ups' (or set ENABLE_SIGNUP=False and restart).
- Don't publish it on a public IP: bind to 127.0.0.1 or your VPN interface and put an authenticating reverse proxy (or VPN such as Tailscale) in front.
- Block the port at the firewall:
sudo ufw deny 8080.
Verify it’s fixed
curl -m 5 http://YOUR_SERVER_IP:8080/api/config # should time out; if reachable, "enable_signup" must be false
References
Not sure if your stack is exposed?
Run the free check: usually under a minute, safe read-only probes.
Scan your stack