Ollama Vulnerability Review: SSRF Bug in Model Pulls Bypassed an Earlier CVE Fix

A security report filed against Ollama describes a server side request forgery vulnerability in the system used to download tensor model layers. The reported flaw appeared in a separate transfer path from the one previously patched for CVE-2026-5530, allowing redirects from a malicious model registry to reach network addresses that Ollama was not supposed to contact. The researcher says the behavior was reproduced against Ollama 0.30.0 in Docker after first reporting it privately in June 2026. Ollama has since merged a broader redirect validation change, and the fix is included in the current Ollama 0.35.1 release.

The vulnerability is useful to examine because it shows how a security patch can correctly protect one implementation path while leaving another path with nearly identical behavior. Ollama had already added redirect restrictions to its older download mechanism after CVE-2026-5530, but tensor model transfers used another implementation under the project's transfer subsystem. The report argued that this second path continued accepting redirects to different hosts without applying equivalent network restrictions. A September patch now applies additional validation to registry and blob redirects across the newer transfer path as well.

What the Ollama vulnerability allowed

Ollama downloads model files from registries when a model is pulled. A registry normally tells Ollama where the required model components can be obtained, and HTTP redirects can legitimately move those downloads to another storage location. The vulnerability report found that the tensor transfer implementation could accept a redirect from the original registry and continue the request against another host without first confirming that the destination was appropriate. A malicious registry could therefore attempt to make the Ollama process send requests toward services available from the machine or network where Ollama was running.

This vulnerability class is called server side request forgery, usually abbreviated SSRF. The attacker is not directly connecting to the protected internal destination but instead causes a trusted application to make the connection on their behalf. The security consequence depends heavily on what the Ollama machine can reach, since an isolated desktop and a server inside a cloud or corporate network expose very different internal resources. The original report specifically focused on the ability to redirect model blob requests toward internal addresses that should not normally be reachable through an external model registry.

The previous CVE fix protected a different download path

CVE-2026-5530 had already addressed redirect behavior in Ollama's older download implementation. That fix added redirect checking to the relevant HTTP client so a registry could not simply redirect a blob request from its own host toward an internal destination. The July report found that tensor model layers could travel through a newer transfer implementation instead, where redirect handling followed a different path. The researcher therefore described the new issue as a bypass of the protection introduced for the earlier CVE rather than a completely unrelated vulnerability.

The distinction is technically significant because both pieces of code ultimately perform model downloads but do not share identical redirect logic. Fixing the older path did not automatically change the newer tensor transfer path. According to the report, that transfer implementation explicitly handled redirects and could return a new destination when the host changed. This created a second security boundary that required its own validation rather than inheriting the protection already added elsewhere.

What an attacker would need

The report does not describe a situation where merely running Ollama allows an arbitrary Internet user to compromise the machine. An attacker would need the ability to make a reachable Ollama server pull a model from infrastructure controlled by the attacker or otherwise influence the registry involved in that pull. The malicious registry could then respond to a model component request with a redirect pointing somewhere the Ollama host could access. Ollama would make the resulting network request using the connectivity available to its own process.

That requirement changes the practical exposure considerably. A personal Ollama instance that is only available to its owner presents a different attack surface from an Ollama API exposed to other users, applications, containers, or network clients. The vulnerability becomes more relevant when model pulling can be initiated remotely or when an untrusted party can influence which registry Ollama contacts. It is therefore an SSRF vulnerability tied to model retrieval rather than a universal remote execution flaw in every Ollama installation.

Why SSRF can be more serious than an ordinary bad redirect

A normal redirect changes where a client retrieves a resource, but an SSRF flaw changes which networks the application can be persuaded to enter. A server may have access to localhost services, private network systems, container interfaces, management endpoints, or cloud infrastructure that an outside attacker cannot reach directly. If an external registry can cause Ollama to contact one of those destinations, the registry effectively gains a limited view through Ollama's network position. The precise information or actions available depend on the services listening at the destination.

The July report demonstrated the unwanted network requests rather than claiming that every target would expose sensitive information. That distinction keeps the finding narrower than claims of automatic credential theft or system takeover. SSRF can become a route toward those outcomes when reachable internal services return valuable responses or accept consequential requests, but those later effects depend on the surrounding environment. The underlying defect was Ollama allowing an external model download to redirect into a network location that should have remained outside the transfer operation.

Ollama's September fix is broader than simply blocking one address

Ollama merged pull request #18512 on September 17, 2026 with changes described as tightening redirect handling for registry and blob transfers. The new implementation validates redirect schemes and destination addresses before following them, checks DNS resolution when a redirect occurs, and blocks an HTTPS connection from being redirected to ordinary HTTP. The transfer path identified in the vulnerability report now calls redirect target validation when a response attempts to move a download to another host. Ollama also added tests designed to confirm that registry redirects cannot silently steer

Ollama 0.35.1 contains the redirect fix

The redirect hardening commit was merged on September 17, and GitHub's commit history shows that the current Ollama 0.35.1 release is built later in the same history with that commit included. Ollama 0.35.1 was published at the end of September and received updated release assets on October 2. The current transfer implementation contains the redirect target checks added by the September patch rather than the behavior described in the original July report. Users running substantially older Ollama releases therefore have a stronger reason to update than users already running the current build.

GitHub issue #17041 remains open, so there has not been a separate public CVE assignment shown for this specific bypass report. The implementation has nevertheless changed in the exact area identified by the researcher, and the merged pull request explicitly describes the goal of preventing registry requests from being redirected toward internal addresses. This provides stronger evidence than simply assuming the issue disappeared because several versions have been released. The present code and current release history show a concrete mitigation for the reported mechanism.

What the Ollama vulnerability shows

The most useful lesson from this vulnerability is not that Ollama model downloads are inherently unsafe. The failure came from having multiple implementations of a similar network operation while applying an earlier security restriction to only one of them. Once tensor transfers gained their own redirect handling, that path needed to enforce the same trust boundary as the older downloader. Security fixes that protect one function can leave the same vulnerability class alive when another subsystem independently performs the same operation.

Ollama's September change addresses the broader mechanism by validating redirects inside the newer transfer system and adding tests around internal destinations. That makes current releases materially different from the 0.30.0 build used in the original report. Users exposing Ollama APIs to other systems should still consider who is allowed to initiate model pulls and whether insecure registry options are necessary. Updating removes the specific redirect behavior described in the report, while sensible network exposure remains a separate configuration decision.

Download Ollama for Windows

Ollama 0.35.1 is available for Windows, and GitHub provides an official PowerShell installation script as part of the current release. Windows users who already have Ollama installed should update rather than remaining on older 0.30.x builds associated with the original vulnerability report. The official Ollama 0.35.1 Windows installer script is available at https://github.com/ollama/ollama/releases/download/v0.35.1/install.ps1

Download Ollama for Mac

Ollama 0.35.1 provides an official Mac application package directly through the project's GitHub releases. The current Mac release contains the redirect hardening commit discussed above and replaces the older vulnerable transfer behavior described in issue #17041. The official Ollama 0.35.1 Mac download is available at https://github.com/ollama/ollama/releases/download/v0.35.1/Ollama-darwin.zip

Download Ollama for Linux

Ollama provides an official Linux installation script and packaged binaries for several Linux hardware configurations. The standard installation script retrieves the appropriate current build rather than requiring users to manually select an architecture archive. The official Ollama 0.35.1 Linux installation script is available at https://github.com/ollama/ollama/releases/download/v0.35.1/install.sh

Ollama GitHub vulnerability report

The original SSRF bypass report remains available as Ollama GitHub issue #17041, where the researcher documents the tensor transfer path involved in the finding. The redirect hardening work was subsequently merged through Ollama pull request #18512 and is present in the current release history. The vulnerability report can be read at https://github.com/ollama/ollama/issues/17041 and the main Ollama repository is available at https://github.com/ollama/ollama