Ollama does not validate the redirect destinations when pulling tensor-layer models, which allows an unauthenticated attacker to cause the server to download blobs from arbitrary hosts. A malicious registry can serve a crafted tensor-layer manifest that redirects the download to a target such as an internal host or a cloud metadata endpoint, enabling the attacker to exfiltrate sensitive data or interact with services that should be inaccessible from outside the network. This flaw is classified under CWE‑918. The impact is critical for confidentiality, integrity, and availability of services behind the vulnerable server.

All installations of Ollama version 0.30.0 through 0.33.2 are susceptible. The vulnerability applies to the Ollama client and server implementation provided by the ollama:ollama product, regardless of operating system.

The flaw carries a CVSS score of 8.7, indicating a high severity level. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalogue. Because the weakness is exploitable without authentication and relies solely on the ability to serve a malicious model manifest to the target host, the attack vector is inferred to be from an external source that can control a model registry. Once a registry is under attacker control, the vulnerable Ollama installation will automatically issue outbound GET requests to the attacker‑specified host, potentially exposing internal resources.