A newly disclosed CVE-2026-85180 lets unauthenticated attackers exploit Ollama’s model-puller to launch server-side request forgery (SSRF) attacks against internal services, including cloud metadata endpoints. The flaw survives in the current release, version 0.33.2, and can be triggered without a valid Ollama account.

Why the vulnerability matters

Many teams run an internal Ollama server to serve LLM models to developers and CI pipelines. The API that delivers models is often left open so any user on the internal network can request a model by name. That convenience creates a direct path from the public-facing API into the private network. CVE-2026-85180 turns the path into a weapon.

An attacker who hosts a malicious model registry can craft a manifest that redirects the download request to any address the Ollama process can reach. When the pull API receives the manifest, it follows the redirect automatically. Because the pull endpoint does not require authentication, the attacker needs no Ollama account. The redirect can point at loopback, link-local, or any private subnet, giving the attacker a foothold inside the victim’s cloud VPC or on-premise network.

The most dangerous target is the cloud metadata service (typically 169.254.169.254). That endpoint hands out temporary credentials to the instance.

How the bug slipped through previous fixes

Earlier this year Ollama patched a redirect issue identified as CVE-2026-5530. The fix added a check that blocked redirects to private addresses, but it applied only to the primary downloader component. The tensor model downloader, which handles a different class of model files, uses a separate HTTP client library. That library processes redirects manually and lacks any validation of the new destination. Consequently, the old guard never runs for those downloads, leaving the SSRF vector open.

Who stands to lose

Enterprises that expose an Ollama endpoint to a broad set of developers face the highest risk. Cloud-native workloads that rely on metadata-driven credentials are especially vulnerable.

What can be done right now

A patch has not been released, and the vulnerability remains in version 0.33.2. Until an official fix lands, operators should harden the network layer around the Ollama process.

  • Stop arbitrary model references. Restrict the API so only trusted users or services can submit model names. Reject unknown or user-supplied registry URLs.
  • Lock down outbound traffic. At the container, host, or firewall level, block connections to loopback, link-local, and private IP ranges from the Ollama process. Explicitly deny access to the cloud metadata address (169.254.169.254) unless the workload truly needs it.
  • Use a curated registry. Host an internal model registry that only serves vetted manifests. Apply an allow-list of hostnames and reject any redirects that point elsewhere.
  • Monitor for suspicious pulls. Scan Ollama logs for pull requests that immediately generate network traffic to internal addresses. Correlate with network telemetry to spot unexpected outbound connections.

What to watch next

Keep an eye on the project’s release notes and security advisories for the forthcoming patch. In the meantime, treat the model-puller as a network-capable service and apply the four mitigations immediately.

Takeaway: An unauthenticated SSRF flaw in Ollama’s model downloader can expose cloud credentials and internal APIs; until a patch arrives, block outbound access to private networks, restrict model references, and monitor pull activity.