Ollama: Critical Ollama Memory Leak Vulnerability Exposes 300,000 Servers Globally

Critical "Bleeding Llama" Flaw Exposes 300,000 Ollama Servers to Data Theft

A severe vulnerability in Ollama, a widely used platform for running local AI models, has left roughly 300,000 internet-facing servers vulnerable to memory-based data extraction. Dubbed "Bleeding Llama" (CVE-2026-7482), the flaw allows unauthenticated attackers to steal sensitive information including user prompts, system instructions, and environment variables with just three API calls.

Discovered by Cyera and assigned a critical CVSS score of 9.1, the exploit stems from a memory overread during the processing of GGUF model files. Attackers can craft malicious files with mismatched tensor metadata, tricking Ollama into reading beyond intended memory buffers. The leaked data, preserved through a lossless conversion technique, is then exfiltrated via the platform’s push functionality.

The impact is particularly severe in enterprise environments, where exposed memory may contain API keys, proprietary code, customer data, and internal AI workflows. Systems integrated with external tools or coding assistants face heightened risk, as their outputs may also be compromised.

The vulnerability affects Ollama versions before 0.1.7.1, which includes the patch. Organizations are advised to upgrade immediately, restrict public access, and enforce authentication controls. Any previously exposed deployments should assume potential data leakage and rotate secrets.

Source: https://cybersecuritynews.com/ollama-vulnerability-exposes-servers/

Ollama TPRM report: https://www.rankiteo.com/company/ollama

"id": "oll1778142229",
"linkid": "ollama",
"type": "Vulnerability",
"date": "5/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': '300,000 servers (enterprise and '
                                              'individual users)',
                        'industry': 'Technology/AI',
                        'name': 'Ollama',
                        'type': 'AI Platform'}],
 'attack_vector': 'Memory Overread via Malicious GGUF Model Files',
 'data_breach': {'data_exfiltration': "Yes (via Ollama's push functionality)",
                 'file_types_exposed': 'GGUF model files (malicious)',
                 'sensitivity_of_data': 'High (enterprise secrets, AI '
                                        'workflows, customer data)',
                 'type_of_data_compromised': 'Memory-based data (user prompts, '
                                             'system instructions, environment '
                                             'variables, API keys, proprietary '
                                             'code, customer data)'},
 'description': 'A severe vulnerability in Ollama, a widely used platform for '
                'running local AI models, has left roughly 300,000 '
                'internet-facing servers vulnerable to memory-based data '
                "extraction. Dubbed 'Bleeding Llama' (CVE-2026-7482), the flaw "
                'allows unauthenticated attackers to steal sensitive '
                'information including user prompts, system instructions, and '
                'environment variables with just three API calls.',
 'impact': {'data_compromised': 'User prompts, system instructions, '
                                'environment variables, API keys, proprietary '
                                'code, customer data, internal AI workflows',
            'operational_impact': 'Potential exposure of enterprise AI '
                                  'workflows and integrated tools',
            'systems_affected': '300,000 internet-facing Ollama servers'},
 'post_incident_analysis': {'corrective_actions': 'Patch implementation '
                                                  '(Ollama 0.1.7.1), memory '
                                                  'buffer validation, secret '
                                                  'rotation',
                            'root_causes': 'Memory overread during GGUF model '
                                           'file processing due to mismatched '
                                           'tensor metadata'},
 'recommendations': 'Upgrade to Ollama 0.1.7.1 or later, restrict public '
                    'access to servers, enforce authentication, rotate exposed '
                    'secrets, assume potential data leakage for previously '
                    'exposed deployments',
 'references': [{'source': 'Cyera'}],
 'response': {'containment_measures': 'Upgrade to Ollama version 0.1.7.1 or '
                                      'later, restrict public access, enforce '
                                      'authentication controls',
              'remediation_measures': 'Patch deployment (Ollama 0.1.7.1), '
                                      'rotation of exposed secrets',
              'third_party_assistance': 'Cyera (vulnerability discovery)'},
 'title': "Critical 'Bleeding Llama' Flaw Exposes 300,000 Ollama Servers to "
          'Data Theft',
 'type': 'Data Breach',
 'vulnerability_exploited': 'CVE-2026-7482 (Memory Overread in GGUF Model File '
                            'Processing)'}