CVE-2026-5530: 
Wolfi vulnerability analysis and mitigation

CVE-2026-5530 is a Server-Side Request Forgery (SSRF) vulnerability in Ollama's Model Pull API, affecting versions up to and including 18.1. The flaw resides in the server/download.go file and allows a low-privileged, authenticated remote attacker to manipulate requests and cause the Ollama server to issue unintended requests to arbitrary internal or external endpoints. It was published on April 5, 2026, with the vendor reportedly not responding to early disclosure attempts. The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where the Model Pull API in server/download.go fails to sufficiently validate or restrict the URLs it fetches when processing model pull requests. An attacker with low-level authenticated access can supply a crafted model registry URL pointing to an attacker-controlled or internal endpoint, causing the Ollama server to make outbound HTTP requests on the attacker's behalf. Exploitation requires only network access and a low-privilege account — no user interaction or elevated permissions are needed. A public proof-of-concept Python script (poc.py) is available that implements multiple attack modes including internal endpoint enumeration, SSRF response exfiltration, and binary-search-based probing via a rogue OCI registry (GitHub Advisory, PoC Repository).

Successful exploitation allows an authenticated attacker to force the Ollama server to send HTTP requests to arbitrary internal or external systems, potentially exposing sensitive internal services such as metadata APIs, databases, or other microservices not intended to be publicly accessible. The impact spans low-level confidentiality, integrity, and availability degradation on the vulnerable system itself, with no direct impact on subsequent systems per the CVSS v4.0 assessment. In environments where Ollama has broad internal network access, this vulnerability could serve as a pivot point for lateral movement or data exfiltration from internal infrastructure (GitHub Advisory, Red Hat Bugzilla).

A fully functional public proof-of-concept exploit (poc.py) is available on GitHub, implementing three operational modes: enum (enumerate live internal endpoints), exfil (exfiltrate SSRF responses), and probe (binary search for response size then exfiltrate), all targeting real Ollama instances via a rogue OCI registry. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.032% (very low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (PoC Repository, GitHub Advisory).

1. Reconnaissance: Identify Ollama instances (version ≤ 18.1) exposed on the network using tools like Shodan or Censys, or enumerate internal deployments. Obtain low-privilege credentials or an API token for the target Ollama instance.
2. Set up rogue OCI registry: Deploy an attacker-controlled HTTP server that mimics an OCI-compliant container/model registry. Configure it to redirect or respond with manifests pointing to internal target URLs.
3. Craft malicious model pull request: Send a model pull API request to the Ollama server (e.g., POST /api/pull) specifying the attacker-controlled registry as the model source, embedding the internal target URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata) within the registry response.
4. Trigger SSRF: The Ollama server processes the pull request and fetches the URL specified in the rogue registry manifest, issuing an HTTP request to the internal or external target on the attacker's behalf.
5. Exfiltrate response: Use the exfil or probe mode of the PoC script to retrieve the server's response to the internal request, extracting sensitive data such as cloud instance metadata, internal API responses, or service credentials (PoC Repository, GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from the Ollama server process to internal RFC-1918 addresses, cloud metadata endpoints (e.g., 169.254.169.254), or unknown external registries; connections to non-standard OCI registry hosts during model pull operations.
• Logs: Ollama server logs showing POST /api/pull requests referencing unusual or external registry URLs; HTTP requests in server logs to internal services not normally accessed by Ollama.
• Process: The Ollama service process initiating outbound connections to internal network segments or cloud metadata services outside of normal model download patterns.
• File System: Presence of the PoC script poc.py or related files associated with the davidrxchester/CVE-2026-5530 repository on attacker-controlled or compromised systems used to stage the attack (PoC Repository).

Upgrade Ollama to a version newer than 18.1 once a patched release is available; the GitHub Advisory notes patched versions are currently unknown, indicating users should monitor the official Ollama repository for updates. As interim mitigations: restrict network access to the Ollama Model Pull API endpoint to trusted users and IP ranges only; implement network segmentation to limit what internal services the Ollama server can reach; and enforce egress filtering to block the Ollama process from making outbound requests to internal RFC-1918 ranges or cloud metadata endpoints. Monitor outbound requests from the Ollama service for anomalous activity (GitHub Advisory, Red Hat Bugzilla).

Red Hat's Product Security team opened a tracking bug (Bug 2455147) and classified the vulnerability as medium severity, with 37 users CC'd indicating broad internal attention. The vulnerability was noted as unreviewed in the GitHub Advisory Database, and the vendor (Ollama) reportedly did not respond to early disclosure attempts, which has drawn some community attention. Social media activity was observed on Bluesky shortly after publication, and the vulnerability was picked up by multiple threat intelligence aggregators including INCIBE-CERT and Offseq Radar (Red Hat Bugzilla, GitHub Advisory).