CVE-2026-5530: Ollama Model Pull API SSRF Vulnerability

CVE-2026-5530 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Ollama versions up to 18.1. The flaw exists in the server/download.go file within the Model Pull API component, allowing remote attackers to manipulate server-side requests. This vulnerability enables an authenticated attacker to craft malicious requests that cause the server to make unintended outbound connections, potentially accessing internal services or sensitive resources.

Critical Impact

Remote attackers can exploit this SSRF vulnerability to bypass network security controls, access internal services, and potentially exfiltrate sensitive data from isolated network segments.

Affected Products

• Ollama versions up to 18.1
• Model Pull API component
• server/download.go processing module

Discovery Timeline

• 2026-04-05 - CVE-2026-5530 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-5530

Vulnerability Analysis

This SSRF vulnerability (CWE-918) affects the Model Pull API in Ollama, specifically within the server/download.go file. The vulnerability allows authenticated remote attackers to manipulate request parameters to force the server to make arbitrary HTTP requests to unintended destinations.

SSRF attacks are particularly dangerous in cloud and containerized environments where internal metadata services, databases, and administrative interfaces may be accessible from the server's network perspective but should not be reachable by external users. The network-based attack vector with low complexity makes this vulnerability relatively easy to exploit once an attacker has basic authentication credentials.

The vendor was contacted regarding this disclosure but did not respond, leaving users without official guidance on mitigation strategies.

Root Cause

The root cause of this vulnerability lies in insufficient validation and sanitization of user-supplied URLs or parameters in the Model Pull API endpoint. When processing model download requests through server/download.go, the application fails to properly validate the destination of outbound requests, allowing attackers to redirect server-side requests to arbitrary internal or external endpoints.

Attack Vector

The attack can be launched remotely over the network by an authenticated user. An attacker can submit a crafted request to the Model Pull API containing a manipulated URL or model reference that redirects the server's download operation to an attacker-controlled or internal target. This allows the attacker to:

1. Probe internal network services and infrastructure
2. Access cloud metadata endpoints (e.g., AWS IMDSv1, GCP metadata)
3. Bypass firewall restrictions by using the server as a proxy
4. Exfiltrate data through DNS or HTTP requests to external servers

The vulnerability requires low privileges (authenticated access) but no user interaction, making it suitable for automated exploitation once initial access is obtained.

Detection Methods for CVE-2026-5530

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests from the Ollama server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
• Abnormal DNS queries originating from the Ollama service to external domains
• Model pull requests containing suspicious URLs or IP addresses in request parameters

Detection Strategies

• Monitor network traffic from Ollama instances for connections to unexpected internal services or cloud metadata endpoints
• Implement application-level logging on the Model Pull API to capture all incoming requests and destination URLs
• Deploy network segmentation and IDS rules to alert on SSRF-indicative traffic patterns
• Review web server access logs for anomalous request patterns targeting the /api/pull or similar endpoints

Monitoring Recommendations

• Configure SIEM alerts for outbound connections from Ollama servers to RFC 1918 private address ranges
• Enable verbose logging on the Ollama service to capture full request details for forensic analysis
• Implement egress filtering and monitor for blocked connection attempts indicating exploitation attempts
• Establish baseline network behavior for Ollama instances to identify deviations

How to Mitigate CVE-2026-5530

Immediate Actions Required

• Restrict network access to the Ollama Model Pull API to trusted sources only using firewall rules
• Implement egress filtering to prevent the Ollama server from making requests to internal networks or cloud metadata services
• Place Ollama instances in isolated network segments with limited internal access
• Monitor for exploitation attempts while awaiting an official patch from the vendor

Patch Information

No official patch has been released by the vendor at this time. The vendor was contacted about this disclosure but did not respond. Users should monitor official Ollama channels for security updates and consider implementing the workarounds below until a patch is available.

For additional technical details, refer to VulDB Vulnerability #355283 and the VulDB Submission #782107.

Workarounds

• Implement a web application firewall (WAF) or reverse proxy with URL validation rules to filter malicious requests before they reach Ollama
• Configure network-level controls to block outbound requests from Ollama to internal IP ranges and cloud metadata endpoints
• Use network policies in Kubernetes or container orchestration platforms to restrict Ollama's network access
• Consider disabling the Model Pull API entirely if not required for your use case until a patch is available

# Example iptables rules to block SSRF to internal networks
# Apply on the Ollama host to prevent SSRF to common internal ranges

# Block requests to private IPv4 ranges
iptables -A OUTPUT -m owner --uid-owner ollama -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner ollama -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner ollama -d 192.168.0.0/16 -j DROP

# Block requests to cloud metadata endpoints
iptables -A OUTPUT -m owner --uid-owner ollama -d 169.254.169.254 -j DROP

# Block requests to localhost
iptables -A OUTPUT -m owner --uid-owner ollama -d 127.0.0.0/8 -j DROP