CVE-2026-85180: Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect
Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker must control a model registry and serve a malicious tensor-layer manifest. They can use redirects in blob downloads to make the Ollama server send GET requests to arbitrary hosts.
Which systems are most exposed?
Ollama instances that pull tensor-layer models from an attacker-controlled registry are exposed. The impact is especially relevant where the Ollama server can reach internal-only services or cloud metadata endpoints.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction.
How can I determine whether an instance is affected?
Check whether the deployed Ollama version is from 0.30.0 through 0.33.2 and whether it pulls tensor-layer models. Review download activity for blob requests redirected to hosts outside the intended registry, particularly internal addresses or cloud metadata endpoints.