ollama - 💡(How to fix) Fix Experimental web_search/web_fetch endpoints expose SSRF vector — no target restrictions

CWE-918: Experimental Web Search/Fetch Endpoints — SSRF Risk

Severity: MEDIUM (CVSS 6.5)

Location

server/routes.go — route registration:

r.POST("/api/experimental/web_search", s.WebSearchExperimentalHandler)
r.POST("/api/experimental/web_fetch", s.WebFetchExperimentalHandler)

Description

Ollama exposes experimental /api/experimental/web_search and /api/experimental/web_fetch endpoints that make outbound HTTP requests on behalf of the caller. These endpoints:

1. Are exposed on the same unauthenticated API surface as all other endpoints
2. Have no visible allowlist/denylist for target URLs
3. Can potentially reach internal services, cloud metadata endpoints, and localhost services

Combined with the default OLLAMA_HOST=127.0.0.1:11434 binding, an attacker with local access can use these endpoints to:

• Probe internal network services
• Access cloud metadata endpoints if Ollama runs on a cloud VM
• Bypass network segmentation

Impact

If Ollama is bound to a non-loopback interface (a common setup for LAN sharing), any device on the network can use Ollama as an SSRF proxy to scan internal infrastructure.

Remediation

1. Block requests to private/internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16)
2. Block cloud metadata endpoints (169.254.169.254, metadata.google.internal, 100.100.100.200)
3. Add a configurable allowlist for web search/fetch targets
4. Consider requiring explicit opt-in before these endpoints are available