Description

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T13:17:27.457Z",
  "pubdate": "2026-10-12T13:17:27.457Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in Ollama versions up to 0.34.1. The flaw exists within the Pull API component, specifically involving the validation logic for model naming conventions.\nThis vulnerability allows a remote, unauthenticated attacker to manipulate the Pull API to induce the server into making unauthorized requests to internal or external resources.\nThe risk implication is significant as it potentially grants an attacker the ability to interact with internal services unreachable from the public internet, bypass network access controls, or perform reconnaissance on the local network infrastructure.\nSuccessful exploitation requires the ability to interact with the Ollama Pull API. The vulnerability has been confirmed with public exploit availability, necessitating immediate remediation to maintain system integrity.",
  "technicalDetails": "The root cause of this vulnerability is an improper input validation mechanism within the IsValid function located in the types/model/name.go file of the Ollama Pull API component. The validation logic fails to adequately sanitize or restrict the model names provided during a pull request.\nIn the affected versions (up to 0.34.1), the Pull API logic processes user-supplied strings intended to identify models. Because the IsValid function does not sufficiently constrain these inputs, an attacker can craft a malicious model name that includes URI schemes or specific host definitions.\nThe attack flow begins when an attacker sends a crafted request to the Ollama Pull API. By manipulating the input parameter processed by IsValid, the attacker can force the backend service to interpret the input as a network resource location. When the service subsequently attempts to resolve or fetch the 'model'—expecting a container or registry path—it instead performs an HTTP request to an attacker-controlled destination or an internal server resource (e.g., localhost or internal metadata services like the AWS Instance Metadata Service).\nThis SSRF vulnerability is particularly dangerous because it bypasses standard network perimeter security. Since the requests originate from the server process itself, they appear legitimate to internal services that may rely on IP-based authentication or local network trust. The exploitation does not require prior authentication, allowing any entity with network reach to the Ollama API to trigger the request.\nThe post-exploitation impact includes the potential for full server-side request forgery, which can lead to data exfiltration, the exploitation of other internal services that lack robust authentication, or the mapping of internal network topologies. The patch identified by commit dfabde4539e42ba1e1eab50a3a50b88aea7958a0 updates the validation logic to enforce strict naming conventions, effectively neutralizing the ability to inject arbitrary URIs or hostnames into the retrieval process."
}