Description

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T15:17:39.250Z",
  "pubdate": "2026-09-03T15:17:39.250Z",
  "executiveSummary": "Ollama suffers from a critical Server-Side Request Forgery (SSRF) vulnerability due to insufficient validation of redirect destinations during the retrieval of tensor-layer models.\nThis vulnerability allows an unauthenticated remote attacker to influence the application to perform arbitrary HTTP GET requests against internal network resources, including sensitive cloud metadata services.\nThe flaw resides in the model manifest processing logic, where the system fails to verify that the destination URL of a redirect maintains the same authority as the original registry host.\nBy controlling a malicious registry, an attacker can serve crafted manifests that force the Ollama server to act as a proxy, potentially bypassing network firewalls and accessing internal infrastructure that is not exposed to the public internet.\nThe risk is categorized as high, as it grants an attacker the ability to interact with internal services, extract cloud environment configuration, or probe internal microservices, which can lead to further exploitation, data exfiltration, or credential theft within the host environment.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of HTTP redirects during the blob download phase of model pulling. When Ollama interacts with a registry to fetch tensor-layer models, the client library follows redirects provided by the server without validating the hostname or target destination of the redirected request.\nThe attack flow initiates when a user or automated process attempts to pull a model from an attacker-controlled registry. Upon sending the request for the manifest or the associated model blobs, the malicious registry returns an HTTP 3xx redirect status code, pointing the Ollama client to an arbitrary, attacker-chosen URL.\nBecause the client does not constrain the redirect to the expected registry origin, the underlying HTTP request mechanism executes a GET request to the specified target. This behavior enables the exploitation of internal network boundaries. An attacker can supply a URL pointing to internal infrastructure, such as 'http://169.254.169.254/latest/meta-data/' in cloud-native environments, to retrieve sensitive instance metadata, environment variables, or IAM credentials.\nThe vulnerability occurs within the model registry client implementation responsible for blob transport. This component fails to enforce origin consistency or block requests to loopback and link-local addresses (such as 127.0.0.1 or 169.254.0.0/16).\nSince the model pulling operation often runs with system-level privileges or elevated service identities, successful exploitation allows the attacker to achieve post-exploitation objectives, including SSRF-based service discovery, port scanning of internal network segments, and the potential exfiltration of cloud metadata tokens.\nThe attack requires no authentication to the target Ollama instance, as the exploitation is triggered by the model pull request itself. The exposure is limited only by the network reachability of the Ollama host, which often resides within internal VPCs or secure segments where it can reach internal metadata services or other sensitive endpoints."
}