2026-09-02

Four open-source AI stacks, open by default

We set up four widespread open-source AI stacks on our own hardware. The findings below date from 31 August 2026, on Langflow 1.11.5, Dify 1.17.0 and Hermes v2026.8.27. Three of the four left account creation open to the public Internet, and one of them actually served this page for a day before we found it. In none of the three cases did the documentation mention it.

The official image, and the illusion of a safe setting

An official Docker image, an environment variable for the public URL, a reverse proxy in front: this is how these tools present themselves, and this is how we deployed them, following their documentation. The shortcut this presentation allows fits in one word: “official” is read as “closed by default”.

OpenWebUI

The service answered on its domain and the model came through correctly, so that nothing, among what can be checked, called for attention. What could not be seen came down to two behaviours whose combination makes the flaw: the sign-up page accepted anyone, and the first account created became administrator. We drew a rule from it: any stack that ships its own authentication is closed in the same session in which it gets a domain name, not the next day.

Langflow

The image already sets LANGFLOW_AUTO_LOGIN=false, the setting everyone quotes. But LANGFLOW_ENABLE_SIGNUP is true by default. Neither of these two facts appears in the project's Docker documentation; both come out of the authentication module shipped in the image.

Dify

Its installation page is protected by an INIT_PASSWORD variable, and the mechanism is correct. What is not is its default value: empty in the example file provided. A deployment that copies the template without rereading it publishes an open installation page.

Hermes

Hermes is the engine our own installations run on, and it was put through the same check as the other three. It refuses to serve a public interface without an authentication gate: the setting that allowed removing it has had no effect since a hardening in June 2026, and when authentication is not configured, the dashboard becomes unreachable rather than open.

The rule we keep from it

A project's documentation is no longer, for us, the source of truth on its authentication settings: two stacks said nothing about it, and the third documented its lock while shipping its value empty. Before a stack gets a domain name, we read the configuration module shipped in the image, then we check from the outside what that reading announces. The check takes half an hour.

A stack has more than one authentication switch, and the settings module shipped in the image is more reliable than the project's documentation.