CVE-2026-85180: High SSRF in Ollama Tensor Pulls

CVE-2026-85180 is a high severity server side request forgery in Ollama. When pulling a tensor layer model, the server follows redirects to any host, so a registry an attacker controls can steer requests toward internal addresses such as cloud metadata. VulnCheck lists 0.30.0 through 0.33.2 as affected.

What's affected

• Product: Ollama, tensor layer download path in x/transfer/download.go.
• Affected per VulnCheck: 0.30.0 through 0.33.2.
• Fixed version: not confirmed. The public issue (#17041) references a commit from 26 August 2026 titled "x/transfer: block redirects to private and link-local hosts", but the issue was still open when read and no release number was given. Check the Ollama releases page.

Severity in the record: High, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). VulnCheck scores it 8.7 under CVSS v4. The record has 7.5 under CVSS v3.1.

Weakness class: CWE-918 (Server-Side Request Forgery).

How to check if you're exposed

1. Run ollama --version on each host, or read the container image tag.
2. Decide whether the API port is reachable by anyone untrusted. The issue describes an unauthenticated pull request, so reachability of the API is the key question.
3. Review which registries your servers pull from. Pulls from hosts you do not run or trust are the trigger.
4. On cloud hosts, check whether the instance metadata service accepts simple requests. A stricter mode limits what a forged request can fetch.

What to do now

1. Check the Ollama releases for a version that includes the redirect fix, and upgrade when you can confirm it.
2. Do not expose the Ollama API to untrusted networks. Put it behind authentication or a private network.
3. Only pull models from registries you control or trust.
4. Block outbound requests from the Ollama host to link-local and private ranges, and require the stricter metadata service mode on cloud instances.
5. Rotate cloud credentials if an exposed host was reachable by untrusted callers.

Why it matters

This one follows an earlier Ollama SSRF fix. The ordinary download path was changed to refuse cross-host redirects, but tensor layer models use a separate code path that handles redirects by hand and returns the new location without checking the host. The same class of bug lived in a second place. The weakness is server side request forgery, CWE-918.

Cloud metadata endpoints are the classic prize, since they can hand out temporary credentials. When you fix one path, search for every other code path that does the same job. The record does not mark this as exploited in the wild.

Try it yourself

Walk through how an API scan surfaces an exposed endpoint that should sit behind authentication.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• VulnCheck advisory
• Ollama issue 17041

Last reviewed: 18 October 2026.