Summary
A server-side request forgery vulnerability in Ollama's Pull API allows attacker-controlled input to influence server-side network requests. When the remotely reachable API accepts a crafted model name or related value, an attacker may cause the Ollama server to contact unintended internal or external resources.
A server-side request forgery vulnerability in Ollama's Pull API allows attacker-controlled input to influence server-side network requests. When the remotely reachable API accepts a crafted model name or related value, an attacker may cause the Ollama server to contact unintended internal or external resources.
Affected context
The issue occurs in Ollama deployments using the Pull API and the model-name validation logic in types/model/name.go. Risk is higher when the API is remotely accessible and validation permits user-controlled values to influence request destinations or resource identifiers without adequately restricting their network interpretation.
The issue occurs in Ollama deployments using the Pull API and the model-name validation logic in types/model/name.go. Risk is higher when the API is remotely accessible and validation permits user-controlled values to influence request destinations or resource identifiers without adequately restricting their network interpretation.
Exploit preconditions
- Attack surface: The remotely accessible Ollama Pull API
- Required access: Network access to an exposed Pull API; authentication requirements depend on deployment configuration
- Trigger point: Processing and validation of attacker-controlled model input
- Why exploitation is possible: Insufficient validation can allow input to influence server-side requests to destinations that were not intended by the service operator
- Attack surface: The remotely accessible Ollama Pull API
- Required access: Network access to an exposed Pull API; authentication requirements depend on deployment configuration
- Trigger point: Processing and validation of attacker-controlled model input
- Why exploitation is possible: Insufficient validation can allow input to influence server-side requests to destinations that were not intended by the service operator
Why this happens
The vulnerability is caused by inadequate validation of input used during Pull API processing. If model-related values are interpreted in a way that permits server-side request destinations or network locations outside an approved set, the application may be induced to make requests on an attacker's behalf.
This behavior maps to CWE-918: Server-Side Request Forgery, where externally influenced input causes a server to issue requests to unintended resources.
The vulnerability is caused by inadequate validation of input used during Pull API processing. If model-related values are interpreted in a way that permits server-side request destinations or network locations outside an approved set, the application may be induced to make requests on an attacker's behalf.
This behavior maps to CWE-918: Server-Side Request Forgery, where externally influenced input causes a server to issue requests to unintended resources.
Potential impact
- An attacker may access services reachable from the Ollama host
- Internal network resources or cloud metadata endpoints could be exposed
- The server could make requests to attacker-controlled external systems
- Sensitive response data could be disclosed if returned through the API
- Network segmentation and access-control boundaries could be weakened
- An attacker may access services reachable from the Ollama host
- Internal network resources or cloud metadata endpoints could be exposed
- The server could make requests to attacker-controlled external systems
- Sensitive response data could be disclosed if returned through the API
- Network segmentation and access-control boundaries could be weakened
General mitigation guidance
Mitigation generally focuses on reducing trust in user-controlled model identifiers and enforcing explicit outbound request policies.
Common defensive patterns include:
- Allowlisting permitted model registries, schemes, hosts, and ports
- Canonicalizing and validating input before any network operation
- Rejecting ambiguous, embedded, or alternate network address representations
- Applying outbound egress controls at the host, container, or network layer
- Blocking access to loopback, link-local, private, and metadata-service addresses unless explicitly required
- Returning only the minimum necessary upstream response data
- Running the service with least-privilege network and filesystem permissions
Mitigation generally focuses on reducing trust in user-controlled model identifiers and enforcing explicit outbound request policies.
Common defensive patterns include:
- Allowlisting permitted model registries, schemes, hosts, and ports
- Canonicalizing and validating input before any network operation
- Rejecting ambiguous, embedded, or alternate network address representations
- Applying outbound egress controls at the host, container, or network layer
- Blocking access to loopback, link-local, private, and metadata-service addresses unless explicitly required
- Returning only the minimum necessary upstream response data
- Running the service with least-privilege network and filesystem permissions
How teams detect issues like this
Organizations can look for SSRF risks through:
- Static analysis of code paths where request parameters influence URLs, hosts, schemes, or redirects
- Code review checks for missing allowlists and incomplete private-address filtering
- API tests covering loopback, private-network, link-local, metadata, alternate-encoding, and redirect cases
- Egress monitoring for unexpected connections from Ollama processes to internal or unusual external destinations
- Network policies that deny unnecessary outbound access and alert on blocked requests
- Automated security review tools that identify user-controlled input reaching HTTP client operations
Organizations can look for SSRF risks through:
- Static analysis of code paths where request parameters influence URLs, hosts, schemes, or redirects
- Code review checks for missing allowlists and incomplete private-address filtering
- API tests covering loopback, private-network, link-local, metadata, alternate-encoding, and redirect cases
- Egress monitoring for unexpected connections from Ollama processes to internal or unusual external destinations
- Network policies that deny unnecessary outbound access and alert on blocked requests
- Automated security review tools that identify user-controlled input reaching HTTP client operations
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
