8.7
High
CVE-2026-85180 Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to…
Description
Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ollama 0.30 | 0.30.0 → 0.33.2 | No fix stated |
References
- GitHub Issue #17041 github.com
- github.com github.com
- x/transfer/download.go at v0.33.2 github.com
- VulnCheck Advisory: Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of Ollama
The 14 CVEs of Ollama →
CVE-2026-103663
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by…
6.9
Medium
CVE-2026-102697
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode…
8.5
High
CVE-2026-65315
Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows…
8.7
High
CVE-2026-15685
Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability
7.5
High