CVE-2026-85180 Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect
Unauthenticated attackers can force Ollama to fetch data from internal hosts or cloud metadata endpoints via malicious model manifests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-85180?
CVE-2026-85180 is a high-severity server-side request forgery vulnerability in ollama, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.
Weakness: CWE-918
Which versions are affected by CVE-2026-85180?
How do I fix CVE-2026-85180?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-85180 being exploited?
There is no known exploitation of CVE-2026-85180 in the wild and no public exploit code.
Sources
Also known as GHSA-57p7-34ff-7w3w, MINI-26j3-3v75-9g3r, MINI-w8qh-4ffj-jfqh.