EUVD-2026-19009Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Ollama up to 18.1. This issue affects some unknown processing of the file server/download.go of the component Model Pull API. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in Ollama's Model Pull API (via server/download.go) allows authenticated remote attackers to manipulate file processing and trigger SSRF attacks, affecting Ollama versions up to 18.1. The vulnerability carries a CVSS score of 6.3 with moderate impact on confidentiality, integrity, and availability. No public exploit code or active exploitation has been confirmed, and the vendor has not responded to early disclosure attempts.
Technical ContextAI
The vulnerability resides in Ollama's Model Pull API component, specifically in the server/download.go file, and stems from improper validation of user-supplied input during file server operations (CWE-918: Server-Side Request Forgery). The flaw allows an authenticated attacker to manipulate requests processed by the file server, causing it to make unintended HTTP requests to internal or external systems. This occurs in the context of model download functionality, where the application fails to adequately restrict which URLs or destinations the server can access on behalf of the client. The affected product is Ollama (CPE: cpe:2.3:a:n/a:ollama:*:*:*:*:*:*:*:*), with versions up to and including 18.1 being vulnerable.
RemediationAI
Users should upgrade Ollama to a version newer than 18.1 once a patched release becomes available from the vendor. However, no vendor-released patch version has been independently confirmed in the available data, and the vendor's non-responsiveness to early disclosure suggests patch development status is unclear. In the interim, restrict network access to Ollama instances and implement strict authentication controls to limit access to the Model Pull API only to trusted users. Network segmentation and outbound firewall rules can help mitigate SSRF impact by preventing the Ollama server from making unauthorized outbound connections. Monitor Ollama instances for unexpected outbound requests or model pull operations from untrusted sources. Additional guidance and updates may be available through VulDB (https://vuldb.com/vuln/355283) and the associated CTI resource (https://vuldb.com/vuln/355283/cti).
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path,
Denial of service in Ollama's multi-modal image processing (versions 0.11.5-rc0 through 0.13.5) lets remote attackers cr
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 8.2), this vulnerability is remotely exploita
A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder [CVSS 7.5 HIGH]
A divide by zero vulnerability exists in ollama/ollama version v0.3.3. Rated high severity (CVSS 7.5), this vulnerabilit
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a customized GGUF model file that,
A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model file that can be u
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
An issue was discovered in Ollama before 0.1.34. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Debian
Bug #1094806| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today