ollama - 💡(How to fix) Fix [HIGH] API has no authentication by default - anyone on the network can run models

Severity: HIGH -- CVSS 7.5

Location: envconfig/config.go, server/routes.go (GenerateRoutes) Category: Missing Authentication / Access Control Confidence: Certain CWE: CWE-306 MITRE ATT&CK: T1190, T1078

Description

Authentication is opt-in and off by default:

UseAuth = Bool("OLLAMA_AUTH")  // defaults to false

The OLLAMA_AUTH environment variable must be explicitly set to enable authentication between the client and server. Without it, anyone who can reach port 11434 can:

• POST /api/generate -- run any downloaded model (GPU compute theft)
• POST /api/pull -- download any model (bandwidth/storage abuse)
• DELETE /api/delete -- delete models
• POST /api/create -- create/modify models
• POST /api/chat -- full chat API access

There is also no rate limiting on any inference endpoint, enabling resource exhaustion attacks (see related finding).

On Docker deployments (OLLAMA_HOST=0.0.0.0:11434), the API is exposed to the entire Docker network and potentially the internet if port-forwarded.

Impact

• GPU compute theft -- attacker runs expensive model inference on your hardware
• Bandwidth abuse -- attacker pulls large models (GBs each) through your connection
• Data destruction -- attacker deletes all locally stored models
• Resource exhaustion -- no rate limiting means unlimited concurrent requests
• Privacy -- attacker can list all models and their metadata via /api/tags

Proof of Concept

# From any machine on same network as the ollama server:
curl http://ollama-host:11434/api/tags
# Returns full model list with no authentication required

Remediation

1. Enable OLLAMA_AUTH by default or prominently document the security implications
2. Add rate limiting middleware (e.g., gin-contrib/limiter) for inference endpoints
3. Consider API key-based authentication for production deployments
4. Add a prominent warning in the Docker README section about network exposure
5. The Ed25519 key-based auth in auth/auth.go appears well-designed -- it just needs to be on by default

What is Done Well

• Server defaults to 127.0.0.1:11434 bind (localhost only)
• Auth protocol uses Ed25519 keys with crypto/rand (not weak PRNG)
• Registry auth validates redirectURL.Host == originalHost to prevent cross-origin token leaks

Found as part of a broader security audit of ollama/ollama.