What happened
A server-side request forgery was found in Ollama's Pull API: the IsValid function in types/model/name.go does not sufficiently validate the model name argument, allowing a remote attacker to make the server issue requests to internal hosts or arbitrary URLs. The exploit has been disclosed to the public, and Ollama 0.34.2 fixes the issue. It is distinct from (and a follow-on to) the previously-announced /api/pull path-traversal RCE.
Why it matters
Ollama is one of the most widely-deployed local/on-prem LLM serving runtimes, and its API commonly binds beyond localhost in container deployments. A public-exploit SSRF on the pull path gives unauthenticated attackers an internal-network and cloud-metadata probe on every exposed Ollama host, which frequently sits adjacent to model stores and deployment secrets.
Attack vector
The IsValid function in the Pull API accepts attacker-controlled model name/URL input and performs a request based on it without proper validation — server-side request forgery, remotely triggerable without authentication (per the CVSS AV:N/PR:N vector) against an exposed Ollama endpoint.
Affected systems
Ollama 0.34.0, 0.34.1 (types/model/name.go IsValid in the Pull API); fixed in 0.34.2
Mitigation
Upgrade to Ollama 0.34.2 (commit dfabde4539e42ba1e1eab50a3a50b88aea7958a0; PR #18512). Keep port 11434 behind an authenticated gateway / reverse proxy as defense in depth.