CVE-2026-85180

Ollama fails to validate redirect destinations when pulling tensor-layer models, a server-side request forgery flaw (CWE-918) that lets blob downloads be redirected to attacker-chosen hosts. An attacker who controls the registry serving the model can supply a malicious tensor-layer manifest, causing the Ollama server itself to issue unauthenticated GET requests to arbitrary internal hosts, including cloud metadata endpoints. The impact is high-confidentiality information exposure from the server's network — for example reading cloud instance metadata and credentials — with no integrity or availability impact in the CVSS 4.0 vector. Anyone running Ollama and pulling models from third-party or attacker-controlled registries is affected, particularly internet-exposed instances whose API can be reached by unauthenticated attackers. As of this analysis there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates the 30-day exploitation probability at roughly 0.3%.

What to do: Upgrade Ollama to the latest release containing the redirect-validation fix (consult the vendor advisory for the exact fixed version, which is not stated in the source data). Until patched, avoid pulling tensor-layer models from untrusted or self-hosted registries, restrict the Ollama server's outbound network access, and block access to the cloud metadata service (e.g., 169.254.169.254) or enforce metadata API v2 on cloud hosts. Additionally, do not expose the Ollama API (default port 11434) to untrusted networks, since unauthenticated reach to the pull interface enables this attack.