CVE-2026-85180
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.
Risk Assessment
The risk includes exploitation of the Ollama server for SSRF attacks, potentially leading to exposure of sensitive data from internal services, including cloud credentials.
Recommendation
It is recommended to upgrade Ollama to a patched version and implement redirect validation and restrict access to internal resources.
Other vulnerabilities in Ollama
See all- CVE-2025-63389Critical
Critical authentication bypass vulnerability in Ollama platform's API endpoints up to v0.12.3. Multiple API endpoints are exposed without authentication, allowing remote attackers to perform unauthorized model management operations.
- CVE-2026-86289Medium
A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.31.2-rc1 is capable of addressing this issue.
- CVE-2026-65315High
Ollama (HEAD f0078ae) has an uncontrolled memory allocation vulnerability in the GGUF metadata parser. A remote attacker can upload a crafted sub-1KB GGUF file via the blob upload and model create/pull APIs, triggering an unrecoverable Go runtime out-of-memory fatal error or makeslice panic that bypasses recovery middleware and crashes the entire server.
- CVE-2026-15685High
A vulnerability in the downloadBlob function in Ollama allows a remote attacker to cause a denial-of-service (DoS) condition without authentication. The issue stems from improper validation of user-supplied data, leading to an out-of-bounds memory access.
- CVE-2026-5757High
An unauthenticated remote attacker can read and exfiltrate the heap memory of the Ollama server through the model quantization engine, leading to sensitive data exposure.
- CVE-2026-5530Medium
Ollama up to version 0.18.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the Model Pull API component (file server/download.go). An attacker can remotely manipulate the request, leading to requests being sent to internal resources.
- CVE-2025-15514High
Ollama versions 0.11.5-rc0 through 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations.
Original NVD description (English source)
Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.