The vulnerability exists in Ollama versions up to 0.18.1 and arises from an unknown processing issue in the server/download.go file of the Model Pull API. By manipulating a request to that endpoint, an attacker can cause the Ollama server to perform unauthorized HTTP calls to arbitrary internal or external resources, constituting a server‑side request forgery (CWE‑918). Remote exploitation can be achieved without authentication, potentially granting the attacker access to sensitive data or enabling further malicious actions.

The flaw affects all installations of Ollama version 0.18.1 or earlier. Any instance running those versions exposes the Model Pull API endpoint, and if that endpoint is reachable from the Internet it is at risk. The vulnerability is confined to the download functionality of the API.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is less than 1%, implying a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue. The attack vector is remote and relies on external manipulation of the download endpoint; no authentication requirement is mentioned, implying that any client able to reach the API could exploit the flaw, thus posing a significant threat for publicly exposed instances.