← fix library

CRITICAL ComfyUI: ComfyUI open to the internet

Why it matters

Anyone can upload and run workflows on your ComfyUI server — workflows can execute arbitrary code on the machine, and the open stats endpoint already shows attackers exactly what GPU hardware you have. Treat an internet-exposed ComfyUI as remote code execution waiting to happen.

Fix it — 3 steps

1. Restart ComfyUI bound to localhost: `python main.py --listen 127.0.0.1` (default is 127.0.0.1 — remove any `--listen 0.0.0.0`).
2. For remote access, keep it on 127.0.0.1 and use an SSH tunnel (`ssh -L 8188:127.0.0.1:8188 user@server`) or an authenticating reverse proxy — never bare on a public IP.
3. Block the port at the firewall: `sudo ufw deny 8188`.

Verify it’s fixed

curl -m 5 http://YOUR_SERVER_IP:8188/system_stats  # should time out / connection refused; curl http://127.0.0.1:8188/system_stats on the server should still work

References

• https://github.com/comfyanonymous/ComfyUI