The Localhost Exposure Report 2026

Exploited dev and AI tools, tunnel abuse on record, tunnel hostnames in public certificate logs, and free-tier changes: the risks of sharing apps from a laptop.

Updated October 1, 2026. Licensed CC BY 4.0.

Key findings

1. The tools developers share are being exploited

Of the 38 CISA Known Exploited Vulnerabilities entries for the developer, AI, and self-hosted tools we track, 19 were added in 2026 alone. AI and ML tools such as Langflow, LiteLLM, n8n, Ray, and MLflow account for 11 of those, against 1 in 2025. CISA’s Vite entry applies only to dev servers exposed to the network, and a public tunnel URL also puts a dev server on the internet. Two caveats: we track tools that already have catalog entries, and most of these AI tools are only a few years old, so the jump partly reflects what we chose to track and when the tools appeared. The 2026 count covers the year so far.

• 20212
• 20227
• 20231
• 20244
• 20255
• 202619

Data: Developer and AI tools in CISA KEV

2. Tunnels are routine attacker infrastructure

Security vendors, governments, and tunnel providers have documented tunnel abuse since at least 2021. Proofpoint tracked campaigns that used account-less TryCloudflare tunnels to deliver remote access trojans; the joint #StopRansomware advisory on Akira lists ngrok among its operators’ tools; and Microsoft’s September 2026 report describes a ransomware affiliate using both cloudflared and ngrok.

Data: Localhost tunnel abuse ledger

3. Tunnel hostnames can be found

Certificate Transparency logs are public, and a peer-reviewed study measured first requests arriving on average 5.9 minutes after a certificate was registered. Tailscale’s documentation warns that machine names are published in those logs when HTTPS is enabled, which Funnel requires. By contrast, the qurl.site hosts that qURL™ recipients land on are covered by a wildcard certificate: on October 1, 2026 the logs showed 3 qurl.site names in total, so no app or link gets its own entry.

Sources: Kondracki et al., USENIX Security 2022, Tailscale Funnel, Tailscale: Enabling HTTPS

4. Free tiers and abuse controls

10 of the 22 tunnel tools we compared require an account before the first URL, and 7 show visitors a warning or reminder page. Changes we track:

• 2026-09-30Cloudflare's quick tunnel documentation adds --allowed-mail, an optional email one-time PIN in front of a quick tunnel. source
• 2024-06-13ngrok requires card verification before free accounts can open TCP endpoints, citing reports of its agent being bundled into malware. source
• 2023-02-28ngrok describes the anti-phishing measures applied to free accounts, including the browser warning page. source

Data: Every way to share localhost, compared

What to do when you share an app

Method

This report draws on the datasets and sources linked above. Each dataset publishes its sources, the date it was built, and how to rebuild it. The Certificate Transparency finding cites published research and Tailscale’s documentation; the only names we counted are qurl.site’s own.

Frequently Asked Questions

Cite this