CVE-2026-5530: Ollama Model Pull API SSRF Vulnerability

CVE-2026-5530 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Ollama versions up to 18.1. The flaw exists in the server/download.go file within the Model Pull API component, allowing remote attackers to manipulate server-side requests. This vulnerability enables an authenticated attacker to craft malicious requests that cause the server to make unintended outbound connections, potentially accessing internal services or sensitive resources.

Critical Impact
Remote attackers can exploit this SSRF vulnerability to bypass network security controls, access internal services, and potentially exfiltrate sensitive data from isolated network segments.

Affected Products

Ollama versions up to 18.1
Model Pull API component
server/download.go processing module

Discovery Timeline

2026-04-05 - CVE-2026-5530 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-5530

Vulnerability Analysis

This SSRF vulnerability (CWE-918) affects the Model Pull API in Ollama, specifically within the server/download.go file. The vulnerability allows authenticated remote attackers to manipulate request parameters to force the server to make arbitrary HTTP requests to unintended destinations.

SSRF attacks are particularly dangerous in cloud and containerized environments where internal metadata services, databases, and administrative interfaces may be accessible from the server's network perspective but should not be reachable by external users. The network-based attack vector with low complexity makes this vulnerability relatively easy to exploit once an attacker has basic authentication credentials.

The vendor was contacted regarding this disclosure but did not respond, leaving users without official guidance on mitigation strategies.

Root Cause

The root cause of this vulnerability lies in insufficient validation and sanitization of user-supplied URLs or parameters in the Model Pull API endpoint. When processing model download requests through server/download.go, the application fails to properly validate the destination of outbound requests, allowing attackers to redirect server-side requests to arbitrary internal or external endpoints.

Attack Vector

The attack can be launched remotely over the network by an authenticated user. An attacker can submit a crafted request to the Model Pull API containing a manipulated URL or model reference that redirects the server's download operation to an attacker-controlled or internal target. This allows the attacker to:

Probe internal network services and infrastructure
Access cloud metadata endpoints (e.g., AWS IMDSv1, GCP metadata)
Bypass firewall restrictions by using the server as a proxy
Exfiltrate data through DNS or HTTP requests to external servers

The vulnerability requires low privileges (authenticated access) but no user interaction, making it suitable for automated exploitation once initial access is obtained.

Detection Methods for CVE-2026-5530

Indicators of Compromise

Unusual outbound HTTP/HTTPS requests from the Ollama server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
Requests to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
Abnormal DNS queries originating from the Ollama service to external domains
Model pull requests containing suspicious URLs or IP addresses in request parameters

Detection Strategies

Monitor network traffic from Ollama instances for connections to unexpected internal services or cloud metadata endpoints
Implement application-level logging on the Model Pull API to capture all incoming requests and destination URLs
Deploy network segmentation and IDS rules to alert on SSRF-indicative traffic patterns
Review web server access logs for anomalous request patterns targeting the /api/pull or similar endpoints

Monitoring Recommendations

Configure SIEM alerts for outbound connections from Ollama servers to RFC 1918 private address ranges
Enable verbose logging on the Ollama service to capture full request details for forensic analysis
Implement egress filtering and monitor for blocked connection attempts indicating exploitation attempts
Establish baseline network behavior for Ollama instances to identify deviations

How to Mitigate CVE-2026-5530

Immediate Actions Required

Restrict network access to the Ollama Model Pull API to trusted sources only using firewall rules
Implement egress filtering to prevent the Ollama server from making requests to internal networks or cloud metadata services
Place Ollama instances in isolated network segments with limited internal access
Monitor for exploitation attempts while awaiting an official patch from the vendor

Patch Information

No official patch has been released by the vendor at this time. The vendor was contacted about this disclosure but did not respond. Users should monitor official Ollama channels for security updates and consider implementing the workarounds below until a patch is available.

For additional technical details, refer to VulDB Vulnerability #355283 and the VulDB Submission #782107.

Workarounds

Implement a web application firewall (WAF) or reverse proxy with URL validation rules to filter malicious requests before they reach Ollama
Configure network-level controls to block outbound requests from Ollama to internal IP ranges and cloud metadata endpoints
Use network policies in Kubernetes or container orchestration platforms to restrict Ollama's network access
Consider disabling the Model Pull API entirely if not required for your use case until a patch is available

bash

# Example iptables rules to block SSRF to internal networks
# Apply on the Ollama host to prevent SSRF to common internal ranges

# Block requests to private IPv4 ranges
iptables -A OUTPUT -m owner --uid-owner ollama -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner ollama -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner ollama -d 192.168.0.0/16 -j DROP

# Block requests to cloud metadata endpoints
iptables -A OUTPUT -m owner --uid-owner ollama -d 169.254.169.254 -j DROP

# Block requests to localhost
iptables -A OUTPUT -m owner --uid-owner ollama -d 127.0.0.0/8 -j DROP