CVE-2026-85180
Received Received - Intake

Ollama Unvalidated Redirect in Tensor-Layer Model Pull

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85180
EUVD
EUVD-2026-70484

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ollama ollama From 0.30.0 (inc) to 0.33.2 (inc)
ollama ollama 0.33.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85180 is a Server-Side Request Forgery (SSRF) vulnerability in Ollama versions 0.30.0 through 0.33.2. It occurs when pulling tensor-layer models because Ollama fails to validate redirect destinations during blob downloads. Attackers can exploit this by hosting a malicious registry that serves a tensor-layer manifest with a redirect to an internal host, causing Ollama to issue GET requests to unintended destinations.

Detection Guidance

Monitor network traffic for unexpected outbound requests to internal or cloud metadata endpoints from Ollama processes. Check logs for repeated GET requests to suspicious IPs or domains during model pulls. Use tools like tcpdump or Wireshark to capture traffic from the Ollama container or process.

Impact Analysis

This vulnerability allows unauthenticated attackers to redirect Ollama's download requests to arbitrary hosts, including internal or cloud metadata endpoints. This could lead to unauthorized access to internal systems, data exfiltration, or further attacks against internal services. The impact includes potential compromise of sensitive data and network resources.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected Ollama versions may face compliance violations, potential data breaches, and regulatory penalties due to insufficient protection against server-side request forgery.

Mitigation Strategies

Upgrade Ollama to the latest version beyond 0.33.2 where the fix is implemented. If upgrading is not possible, restrict network access for the Ollama process to prevent outbound connections to unintended hosts. Review and block suspicious registry endpoints in firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart