CVE-2026-85180 in Ollama
Summary
by MITRE • 09/03/2026
Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability in Ollama represents a critical flaw in how the application handles HTTP redirects during the process of pulling model weights from remote registries. When an attacker controls or compromises a registry serving tensor-layer models, they can craft a malicious manifest that includes redirect instructions pointing to arbitrary destinations rather than legitimate storage endpoints. Because Ollama fails to validate these redirect targets against a whitelist or enforce strict origin checks, it blindly follows the redirections issued by the server. This lack of validation allows an unauthenticated attacker to manipulate the flow of data retrieval, effectively turning the victim machine into a proxy for making requests to internal network resources that would otherwise be inaccessible from the internet.
The operational impact of this flaw is severe, particularly in environments where Ollama runs with access to internal networks or cloud infrastructure metadata services. By directing GET requests toward internal hosts, an attacker can probe the local network topology and potentially exfiltrate sensitive data stored on adjacent systems. A primary target for such attacks is cloud metadata endpoints, which are commonly accessible via non-routable IP addresses like 169.254.169.254 in AWS or similar ranges in other cloud providers. These endpoints often contain temporary security credentials, instance identity documents, and configuration details that can be leveraged for further lateral movement within a compromised environment. The ability to issue these requests without authentication means the attack requires no prior access to the target system beyond the ability to trigger the model pull operation.
From a technical classification perspective, this vulnerability aligns with CWE-601, which describes URL Redirection to Untrusted Site or Domain. It also relates closely to CWE-437, Incomplete Validation of Suffix or Filename in an Authentication Bypass Scenario, as the application fails to verify that the final destination is trusted before proceeding with the request. The attack vector maps directly to MITRE ATT&CK technique T1059.009, Command and Scripting Interpreter via Web Services, specifically through the abuse of legitimate administrative functions for malicious purposes. Furthermore, it falls under T1498, Network Denial of Service or Data Exfiltration over C2 Channels if used to leak data, but more accurately represents T1572, Protocol Tunneling, where a trusted protocol is abused to establish an unauthorized communication channel with internal resources.
Mitigation strategies must focus on implementing strict allow-lists for redirect destinations and enforcing same-origin policies during the download process. Developers should configure Ollama or its underlying HTTP client libraries to reject redirects that point to private IP ranges, loopback addresses, or any host not explicitly whitelisted as a trusted registry mirror. Additionally, running Ollama with network isolation principles can limit exposure; for instance, using containerization with restricted egress rules prevents the application from reaching internal metadata endpoints even if redirected there. Regular auditing of third-party dependencies and ensuring that model sources are verified through cryptographic signatures rather than relying solely on URL integrity will further reduce the risk surface associated with this type of supply chain attack.