What happened
Published to NVD on Sept 3, 2026, this SSRF (CVSS 7.5/8.7 depending on scoring) lets an unauthenticated attacker who controls a model registry redirect Ollama's blob-download requests to internal hosts by serving a crafted tensor-layer manifest.
Why it matters
Ollama is one of the most widely deployed local/self-hosted LLM inference servers; this flaw turns routine model-pulling into an SSRF primitive capable of exposing cloud credentials via metadata services, directly threatening any environment where Ollama runs with cloud IAM roles attached.
Attack vector
Ollama fails to validate the destination of HTTP redirects when pulling tensor-layer model blobs. An attacker who controls a registry (or intercepts a manifest) can serve a malicious tensor-layer manifest that redirects the server's blob-fetch GET requests to arbitrary internal hosts, including cloud metadata endpoints (e.g., 169.254.169.254), with no authentication required.
Affected systems
Ollama 0.30.0 through 0.33.2
Mitigation
Upgrade Ollama past 0.33.2 to the patched release; restrict outbound network egress from Ollama hosts; only pull models from trusted registries.