Issue Station
Sign In
Tools hereToolbox

ollama - 💡(How to fix) Fix Security Disclosure: 7 Critical Vulnerabilities (SSRF, RCE, CORS, Memory Leaks) — Full Public Disclosure

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

After responsible disclosure attempts went unanswered, I am publicly disclosing 7 critical vulnerabilities in Ollama, along with 15+ Proof-of-Concept exploits and 3 CVE requests.

Root Cause

After responsible disclosure attempts went unanswered, I am publicly disclosing 7 critical vulnerabilities in Ollama, along with 15+ Proof-of-Concept exploits and 3 CVE requests.

Fix Action

Fix / Workaround

Author: @k4w_wak
Full Advisory & PoCs: https://github.com/k4w-wak/ollama-silent-patches

The Core Problem: Silent Patching

Ollama has patched multiple security vulnerabilities without disclosure, without CVEs, and without advisories. This means:

RAW_BUFFERClick to expand / collapse

Security Disclosure — Full Public Disclosure

Author: @k4w_wak
Full Advisory & PoCs: https://github.com/k4w-wak/ollama-silent-patches

Summary

After responsible disclosure attempts went unanswered, I am publicly disclosing 7 critical vulnerabilities in Ollama, along with 15+ Proof-of-Concept exploits and 3 CVE requests.

Vulnerabilities

#FindingSeverityCVSS
1SSRF via /api/pull — Attacker-controlled model pulls from internal servicesCritical9.8
2RCE via /api/create — GGUF model hijacking → arbitrary code executionCritical9.1
3CORS Wildcard * — Any origin can interact with local OllamaHigh8.6
4Memory leak via /api/generate — Unbounded memory growth → DoSHigh7.5
5Model poisoning via /api/push — Supply chain attack vectorHigh8.2
6Unauthorized model deletion — /api/delete requires no authMedium6.5
7Information disclosure — /api/show leaks system paths, model internalsMedium5.3

The Core Problem: Silent Patching

Ollama has patched multiple security vulnerabilities without disclosure, without CVEs, and without advisories. This means:

  • Users running older versions are unknowingly vulnerable
  • No one can assess their risk
  • The security community cannot verify fixes
  • This violates responsible disclosure norms

Timeline

  • Vulnerabilities discovered and reported
  • Patches merged silently — no advisory, no CVE, no disclosure
  • Full public disclosure after waiting for proper response

Full Details

All 15+ PoCs, CVSS scores, verification audit, and the complete disclosure timeline are available at:

https://github.com/k4w-wak/ollama-silent-patches

I am happy to work with the Ollama team on CVEs, advisories, and coordinated disclosure going forward. This issue is filed in the spirit of transparency and protecting Ollama's users.

/cc @ollama-maintainers

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING