CVE-2026-85180

Name of the Vulnerable Software and Affected Versions Ollama versions prior to 0.33.2

Description Ollama fails to validate redirect destinations during the process of pulling tensor-layer models. This allows unauthenticated attackers who control a registry to serve a malicious tensor-layer manifest, forcing the server to issue GET requests to arbitrary hosts. This behavior can be used to target internal network services, such as cloud metadata endpoints, through Server-Side Request Forgery (SSRF), which is a technique where an attacker induces a server to make requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Lock down egress traffic to minimize the risk of unauthorized requests to internal services.