{"id":"CVE-2026-85180","title":"Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts","summary":"Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifes…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-918"],"published":"2026-09-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T15:47:22.273","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85180","references":[{"url":"https://github.com/ollama/ollama","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ollama/ollama/blob/v0.33.2/x/transfer/download.go","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ollama/ollama/issues/17041","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ollama-0.30.0-through-0.33.2-ssrf-via-cross-host-tensor-blob-redirect","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85180.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85180"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85180"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00286,"epssPercentile":0.21345,"ingestedAt":"2026-09-10T15:53:17.040Z","vendor":"Red Hat","slug":"CVE-2026-85180","body":"## Overview\n\nOllama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85180.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}