On 23 October 2026, ZoomEye returned 11,181 matches for title="Nomad" and 1 match for port=4646. The gap is two orders of magnitude and it does not mean what it looks like.
Port 4646 is the default HTTP address for a HashiCorp Nomad agent's API and web interface. A title search for the product name matches far more broadly. Neither number is a count of exposed Nomad consoles, and the reason is a lesson about how orchestration tools are published.

Why the port returns almost nothing

A Nomad deployment of any size runs agents on every node. The servers, which hold the Raft state and serve the API, are few. The clients, which run the workloads, are many.
Neither is customarily exposed. Servers are reached by clients over the same network, and operators reach the API through a load balancer, a VPN, or a bastion. Where TLS is enabled, and Nomad's documentation recommends it for production, the agent's HTTP listener is on 4646 with TLS, and a plain port probe does not produce a recognisable response.
That combination, a non-default port selection by many operators plus TLS on the listener, pushes the population out of a port-scoped query entirely. One match is the residue of a default configuration that nobody changed and that reached a public address.

What the 11,181 contains

A title search matches the string in the HTML title element. "Nomad" is a common word and a common product name, and the result set will contain pages that have nothing to do with the orchestrator.
The honest reading is that this number cannot be used to estimate Nomad exposure. What it can do is point at hosts worth inspecting, and only an HTTP request that examines the response body distinguishes a Nomad web UI from a page that mentions the word.
The web UI itself, at /ui, was introduced in Nomad 0.7 and shows jobs, allocations, nodes and servers. It is a read interface by design, and the API behind it accepts job submissions where the token permits.

The token is the actual boundary

Nomad's access control model is built on ACL tokens. Without a token, an agent configured with ACLs enabled rejects requests. With a management token, every operation is available.
The exposure question therefore reduces to a token question. An unauthenticated web UI is a discovery surface that reveals job names, node names and cluster topology. An API reachable with a token that leaked from a CI variable is a workload execution surface.
The second case is why the port count being one and the title count being eleven thousand does not produce a comfortable conclusion. Exposure through a properly configured proxy on 443 with TLS is still exposure, and a port query cannot see it.

Checks that produce evidence

Request /v1/status/leader on any candidate. An agent without ACLs returns the current leader address; an agent with ACLs returns a 403 that names the missing token. Both responses confirm Nomad; only one indicates a configuration that needs attention.
Then request /v1/jobs without a token. A list of job names is a finding about authentication. A 403 is the expected result on a hardened deployment.
For version, /v1/agent/self returns the agent's configuration and version when permitted. Nomad's release notes list current versions, and comparing the reported version to the cluster's declared state is the drift check that catches an upgrade that did not reach every node.
TLS configuration deserves its own line. Nomad's documentation requires tls.http settings on the agent and a certificate that the client trusts, and a deployment that enables TLS on one listener and not another is a common partial migration.

What the record looks like after an incident

Nomad's audit trail, when enabled, records authenticated API requests with the accessor of the token used, the operation and the response code. That is the record an investigator needs for the question "who submitted this job".
Where audit logging is off, the agent's own log records job submission events at INFO level, and those lines rotate. The difference between the two decides whether the question is answerable a week later.
The comparison worth running is between the token inventory and the audit log: can you list every token that submitted a job in the last thirty days, and does that list match the tokens you believe exist? A token that appears in the log and not in the inventory is the finding that matters more than any exposure count.

References

  • HashiCorp Nomad ACL documentation: https://developer.hashicorp.com/nomad/docs/secure/acl

  • HashiCorp Nomad TLS documentation: https://developer.hashicorp.com/nomad/docs/configuration/tls

  • HashiCorp Nomad audit logging: https://developer.hashicorp.com/nomad/docs/configuration/audit

  • HashiCorp Nomad HTTP API: https://developer.hashicorp.com/nomad/api-docs

  • ZoomEye query syntax reference: https://www.zoomeye.org/doc

  • Measurement note: counts collected 23 October 2026 with title="Nomad" (11,181) and port=4646 (1).