Ollama Arbitrary Redirect Vulnerability (CVE-2026-85180)

CVE-2026-85180 describes a critical security flaw in Ollama involving improper validation of redirect destinations during the retrieval of tensor-layer models. An unauthenticated attacker can host a malicious registry that provides a crafted tensor-layer manifest. When an Ollama instance attempts to pull a model from this registry, the server follows HTTP redirects provided by the attacker, leading to unauthorized GET requests. This vulnerability enables Server-Side Request Forgery (SSRF), which can be exploited to probe internal network services or access sensitive cloud metadata endpoints. This is particularly dangerous in cloud-hosted environments where metadata services (like 169.254.169.254) are reachable from the Ollama host, potentially exposing instance identity tokens or environment configuration. Defenders should treat all model pull requests from untrusted registries as a high-risk activity.

Impact

Successful exploitation of CVE-2026-85180 allows attackers to perform internal network reconnaissance and potentially exfiltrate sensitive credentials or configuration data from cloud metadata services. This risk is elevated in environments where Ollama instances have network access to internal resources or cloud management interfaces.

Recommendation

• Monitor for outgoing HTTP GET requests initiated by the Ollama process toward internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and specifically the cloud metadata endpoint (169.254.169.254).
• Restrict the Ollama server's network access to known-trusted external registries only, using firewall egress rules to block communication with unverified model repositories.
• Patch Ollama installations immediately once an update addressing CVE-2026-85180 is released by the vendor.
• Review network logs for the Ollama binary for unusual connections to non-registry destinations or internal hosts.