Loading story…
Oligo Security disclosed six issues in Ollama, the open-source platform for serving large language models locally and remotely. Four received CVE identifiers: CVE-2024-39719, CVE-2024-39720, CVE-2024-39721, and CVE-2024-39722. The reported flaws affect the CreateModel and push APIs and can allow application crashes, resource-exhaustion denial of service, and disclosure of whether files exist on the host.
Ollama fixed CVE-2024-39720, CVE-2024-39721, and CVE-2024-39722 in version 0.1.46, while Oligo said CVE-2024-39719 remained unresolved in version 0.3.14. Oligo also identified unauthenticated pull and push management endpoints as potential routes for model poisoning and model theft, although Ollama maintainers disputed those findings as vulnerabilities. The researchers estimated about 10,000 internet-exposed Ollama IP addresses and assessed roughly one quarter as vulnerable to the reported issues.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
MITRE assigned CVE-2024-39719, CVE-2024-39720, CVE-2024-39721, and CVE-2024-39722 to four of the Ollama vulnerabilities reported by Oligo.
Ollama released version 0.1.46, fixing the denial-of-service issues described in the advisory, including CVE-2024-39720 and CVE-2024-39721, as well as the /api/push path-traversal/file-disclosure issue CVE-2024-39722.
Ollama maintainers confirmed four of Oligo's reported issues and began developing fixes. They did not acknowledge the reported model-poisoning and model-theft conditions as vulnerabilities.
Oligo reported six security issues affecting Ollama, including CreateModel API denial-of-service and file-disclosure flaws, as well as disputed unauthenticated model-pull and model-push issues. Ollama maintainers later disputed the model-poisoning and model-theft reports.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT/CC disclosed **VU#518910** for an Ollama vulnerability that lets unauthenticated remote attackers leak sensitive data from server heap memory through the platform’s model upload feature. The issue, tracked as **`CVE-2026-5757`**, affects Ollama’s handling of specially crafted **GGUF** model files and was reported by researcher Jeremy Brown, who found that malformed uploads could trigger unsafe memory access and expose heap contents during model processing. Reporting said the flaw stems from improper bounds checking in Go code and the creation of a new model layer that can exfiltrate leaked memory through Ollama’s registry API. With no vendor patch available at disclosure and the vendor reportedly unreachable, CERT/CC urged organizations to disable model uploads where possible, restrict Ollama access to trusted local networks, block untrusted external IP addresses, and accept uploads only from verified sources.
Jun 29, 2026
CERT Polska disclosed two vulnerabilities in **Ollama for Windows**—`CVE-2026-42248` and `CVE-2026-42249`—that affect tested versions `0.12.10` through `0.17.5` and expose the software’s update mechanism to malicious payloads. According to the advisory, the first flaw causes the Windows updater to accept downloaded executables without properly verifying their integrity or authenticity, while the second lets attacker-controlled HTTP response headers influence file path construction, enabling path traversal and arbitrary file writes. CERT Polska said an attacker able to tamper with update responses could combine the bugs to stage and run unauthorized code during Ollama’s silent automatic update process. The chained attack could allow malicious executables to be written into sensitive locations such as the **Windows Startup** directory, resulting in automatic and persistent code execution without user awareness. CERT Polska credited Bartłomiej Dmitruk of **striga.ai** with the report and said maintainers were notified early, but no vendor details on the vulnerabilities or affected versions were provided. Separate reporting later listed the Ollama issues among a broader set of publicly validated CVEs attributed by Striga’s tracker, while noting that the AI-assisted discovery claims were self-reported rather than independently confirmed by upstream vendors.
Jul 20, 2026
Researchers disclosed multiple serious security issues affecting AI tooling, led by critical vulnerabilities in **Ollama** that can expose systems and data. Wiz reported `CVE-2024-37032` (**Probllama**), an easy-to-exploit remote code execution flaw caused by improper validation of model manifests from private registries, allowing path traversal, arbitrary file read/write, and code execution—especially in Docker deployments running as root and listening on `0.0.0.0` without authentication. A separate disclosure described `CVE-2026-7482` (**Bleeding Llama**), which can leak heap memory through Ollama’s GGUF model creation and quantization workflow and exfiltrate the resulting artifact via the `/api/push` endpoint, while `CVE-2026-42248` and `CVE-2026-42249` affect the Windows updater and can be chained for persistent code execution through missing signature checks and unsafe `ETag` handling. The disclosures landed alongside a software supply chain incident on **Hugging Face**, where a malicious repository impersonating OpenAI’s Privacy Filter reportedly climbed to the platform’s trending list and drew more than 240,000 downloads before removal. The fake package used cloned documentation and likely inflated engagement metrics to appear legitimate, then delivered a multi-stage Windows infection that gained **SYSTEM**-level persistence, disabled security controls, and deployed the Rust-based stealer **sefirah** to collect wallet data, Discord tokens, developer credentials, browser secrets, screenshots, and sensitive files for exfiltration. Together, the incidents show how exposed AI infrastructure, weak authentication defaults, and trust in popular model and code repositories are creating high-impact attack paths; defenders were urged to upgrade Ollama to fixed versions, avoid direct internet exposure, use authenticated reverse proxies, and scrutinize third-party AI packages before deployment.
Jun 29, 2026