CVE-2026-5530

Executive Summary

CVE-2026-5530 is a Server-Side Request Forgery (SSRF) vulnerability in Ollama versions up to and including 18.1. The flaw resides in the Model Pull API, specifically within the server/download.go file. An unauthenticated, remote attacker can manipulate the pull request to force the Ollama server to make arbitrary HTTP requests to internal or external resources. This can lead to information disclosure, internal network scanning, or further exploitation of internal services. The vendor has been contacted but has not responded, leaving the vulnerability unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch makes it a significant risk for exposed instances.

Supply Chain & Package Security

Ollama is a Go-based application. The vulnerability is in the core server code, not in a third-party package. However, any system or application that integrates with Ollama’s API (e.g., via Docker, Kubernetes, or CI/CD pipelines) is at risk. Users should treat the Ollama server as a potential pivot point in their supply chain.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

CVSS Score: 6.3 (Medium) – While the impact is limited, the ease of exploitation and lack of authentication make it a serious concern for exposed deployments.

Deep Dive & Mechanics

The vulnerability is in the Model Pull API endpoint, which is used to download models from remote registries. The server/download.go file handles the URL parsing and HTTP request generation. The flaw allows an attacker to inject arbitrary URLs or manipulate the request path, causing the server to make requests to unintended destinations.

Root Cause: Insufficient validation of the model name or URL provided by the client. The server does not properly sanitize or restrict the target of the HTTP request, allowing an attacker to specify internal IP addresses (e.g., http://169.254.169.254/latest/meta-data/) or other sensitive endpoints.

Attack Flow:

1. Attacker sends a crafted request to the Ollama API (e.g., POST /api/pull with a malicious model name).
2. The server parses the model name and constructs an HTTP request to the attacker-controlled or internal URL.
3. The server fetches the resource and returns the response (or error) to the attacker, potentially leaking sensitive data.

Example Payload (Conceptual):

{
  "model": "http://169.254.169.254/latest/meta-data/"
}

Vulnerable vs. Patched Code

Since no official patch exists, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual from server/download.go):

func pullModel(modelName string) {
    url := fmt.Sprintf("https://registry.ollama.ai/%s", modelName)
    resp, err := http.Get(url)
    // ... process response
}

The modelName is directly concatenated into the URL without validation.

Patched Code (Hypothetical):

func pullModel(modelName string) {
    if !isValidModelName(modelName) {
        return error("invalid model name")
    }
    url := fmt.Sprintf("https://registry.ollama.ai/%s", url.PathEscape(modelName))
    resp, err := http.Get(url)
    // ... process response
}

The patch would validate the model name against a whitelist of allowed characters and escape it properly.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Ollama server (e.g., http://target:11434).
• No authentication required.

Exploitation Steps:

1. Identify the Ollama API endpoint (default port 11434).
2. Send a POST request to /api/pull with a malicious model name pointing to an internal resource.
3. Observe the response for leaked data.

Example using cURL:

curl -X POST http://target:11434/api/pull -d '{"model": "http://169.254.169.254/latest/meta-data/"}'

Expected Output: The server will attempt to fetch the metadata from the cloud provider and may return it in the error or response.

Blue Team

Detection:

• Monitor for unusual model names containing URLs or IP addresses.
• Look for outbound HTTP requests from the Ollama server to unexpected destinations.
• Alert on repeated failed pull attempts with non-standard model names.

Hunting:

• Search logs for model parameter containing http://, https://, or internal IP ranges.
• Use network monitoring to detect connections from the Ollama server to internal services.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from the Ollama server to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.x.x).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254).
• Logs:
  • API logs showing model parameter with full URLs.
  • Error logs containing responses from internal services.
• File System:
  • Unusual files in the Ollama model cache directory (e.g., files named after internal IPs).

Detection Engineering

YARA Rule

rule CVE_2026_5530_Ollama_SSRF {
    meta:
        description = "Detects SSRF attempts against Ollama Model Pull API"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-5530"
    strings:
        $s1 = "/api/pull" ascii wide nocase
        $s2 = "model" ascii wide nocase
        $s3 = "http://" ascii wide nocase
        $s4 = "https://" ascii wide nocase
        $s5 = "169.254" ascii wide nocase
        $s6 = "10." ascii wide nocase
        $s7 = "192.168" ascii wide nocase
        $s8 = "172." ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5, $s6, $s7, $s8)
}

Sigma Rule

title: CVE-2026-5530 Ollama SSRF Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against Ollama Model Pull API
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: ollama
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/pull'
        cs-uri-query|contains: 
            - 'http://'
            - 'https://'
            - '169.254'
            - '10.'
            - '192.168'
            - '172.'
    condition: selection
falsepositives:
    - Legitimate use of custom model registries (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-5530 Ollama SSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/pull"; http_uri; content:"model"; http_client_body; pcre:"/(http|https):\/\/(169\.254|10\.|192\.168|172\.)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Place the Ollama server behind a firewall and restrict inbound access to trusted IPs only.
2. Disable Unnecessary Features: If the Model Pull API is not required, disable it or block the /api/pull endpoint.
3. Use a Reverse Proxy: Implement a reverse proxy (e.g., Nginx) to validate and sanitize incoming requests before they reach Ollama.

Long-Term Fix:

• Monitor the vendor for an official patch. If none is forthcoming, consider forking the repository and implementing input validation as described in the patched code section.

Workaround:

• Use environment variables or configuration to whitelist allowed model registries.

Valters IT

{/* [Security Hash: D283D1DE91C2713F5ACC0BB6] */}