Description
A flaw has been found in Ollama up to 18.1. This issue affects some unknown processing of the file server/download.go of the component Model Pull API. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-04-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑side request forgery that can allow an attacker to make the Ollama server target arbitrary internal or external resources
Action: Immediate patch
AI Analysis

Impact

The vulnerability resides in the file server/download.go component of the Ollama Model Pull API, enabling server‑side request forgery (SSRF). By manipulating the API request, an attacker can cause the Ollama server to send arbitrary HTTP requests to internal or external resources. This can lead to unauthorized data retrieval, potential exposure of sensitive information, or serve as a pivot for further attacks. The weakness is classified as CWE‑918.

Affected Systems

Affected systems are instances of Ollama version 18.1 or earlier. The flaw exists in all releases up to 18.1, but no earlier versions are identified as vulnerable. Users running these versions are at risk if the Model Pull API is exposed to external traffic.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalogue. The attack vector is remote, relying on external manipulation of the download endpoint. No authentication requirement is mentioned, suggesting that any client able to reach the API could exploit the flaw, thus the threat is significant for publicly exposed instances.

Generated by OpenCVE AI on April 5, 2026 at 03:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check current Ollama version; if 18.1 or older, upgrade to the latest patched release when available.
  • If a fix is not yet available, disable the Model Pull API or restrict its access to trusted networks only.
  • Configure network segmentation or firewall rules to block outbound requests from the Ollama service to internal networks, mitigating SSRF impact.
  • Continuously monitor logs for unusual outbound requests from the Ollama server and set up alerts for suspicious activity.
  • Keep all system components up to date and maintain an intrusion detection strategy for related attacks.

Generated by OpenCVE AI on April 5, 2026 at 03:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Sun, 05 Apr 2026 01:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Ollama up to 18.1. This issue affects some unknown processing of the file server/download.go of the component Model Pull API. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title Ollama Model Pull API download.go server-side request forgery
First Time appeared Ollama
Ollama ollama
Weaknesses CWE-918
CPEs cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*
Vendors & Products Ollama
Ollama ollama
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Ollama Ollama
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T15:37:44.300Z

Reserved: 2026-04-04T06:29:38.195Z

Link: CVE-2026-5530

cve-icon Vulnrichment

Updated: 2026-04-06T15:37:38.377Z

cve-icon NVD

Status : Deferred

Published: 2026-04-05T01:16:48.220

Modified: 2026-04-24T18:13:28.877

Link: CVE-2026-5530

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-05T00:30:13Z

Links: CVE-2026-5530 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:57:25Z

Weaknesses