Latest Ollama vulnerability: CVE-2026-7482 #
Researchers disclosed that certain versions of Ollama are susceptible to a heap out-of-bounds read vulnerability within the GGUF model loader. A remote, unauthenticated attacker could exploit this by sending a specially crafted GGUF file to the /api/create endpoint. When the server processes a GGUF file where the declared tensor offset and size exceed the file's actual length, the functions in fs/ggml/gguf.go and server/quantization.go (WriteTo()) read past the allocated heap buffer during the quantization process.
The resulting memory leak may expose sensitive information, including environment variables, API keys, system prompts, and concurrent user conversation data. This data can then be exfiltrated by uploading the resulting model artifact to an attacker-controlled registry via the /api/push endpoint. In the upstream distribution, the /api/create and /api/push endpoints lack authentication. While default deployments bind to 127.0.0.1, the documented OLLAMA_HOST=0.0.0.0 configuration is common in practice, leading to significant public Internet exposure. This vulnerability has been designated CVE-2026-7482, also known as Bleeding Llama, and has been rated critical with a CVSS score of 9.1.
The following versions are affected:
- Ollama: Versions prior to 0.17.1
What is Ollama? #
Ollama is an open-source framework designed for the local deployment, management, and execution of large language models (LLMs) on personal computing hardware.
What is the impact? #
Successful exploitation of this vulnerability could expose sensitive information, including environment variables, API keys, system prompts, and concurrent user conversation data.
Are updates or workarounds available? #
Users are encouraged upgrade affected systems to the following versions immediately:
- Ollama: Upgrade to 0.17.1 or later.
How to find potentially vulnerable systems with runZero #
From the Software Inventory, use the following query to locate potentially impacted assets:
vendor:=Ollama AND product:=Ollama AND source:runzero
