A vulnerability labeled CVE-2026-85180 has surfaced in Ollama, the open-source tool that serves large language models. Anyone who can supply a model name can make the server contact private network addresses—including cloud-metadata endpoints—without any authentication. The flaw creates an egress-network risk that can expose internal services.
How the exploit works
- An attacker builds a fake model registry that looks like a legitimate source.
- The registry returns a manifest with a URL that redirects to a malicious link.
- When Ollama pulls the model, its tensor-downloader follows the redirect without question.
- The redirected request can target any address, such as the well-known metadata IP 169.254.169.254 or other internal servers behind firewalls.
- Because the download process requires no login, the attacker needs no credentials to trigger the request.
The core issue is that the component that downloads tensor files never checks whether the final host is public or private. Other parts of Ollama perform that check; the downloader does not.
Why it matters
If your Ollama server sits near sensitive APIs or cloud credentials, the ability to reach internal addresses becomes a serious concern.
Current status
Version v0.33.2 is vulnerable. The flaw is identified as CVE-2026-85180.
Immediate protection steps
- Restrict model names: Block untrusted users from specifying arbitrary model identifiers to an Ollama server.
- Egress filtering: Stop outbound traffic from the Ollama host to the cloud-metadata address 169.254.169.254.
- Curated registries: Pull models only from a private, vetted registry you control.
- Log monitoring: Watch for pull requests that resolve to internal IPs or unusual hostnames and alert on any such occurrence.
These steps won’t patch the flaw, but they raise the bar enough to buy time until an official fix lands.
Takeaway: Ollama’s convenience hides a network exposure; until the patch arrives, block its ability to talk to internal addresses and limit who can request model downloads.