Critical Ollama Bug Exposes AI Server Memory to Remote Attackers

A serious security hole in the popular open-source AI framework Ollama could let remote attackers siphon entire chunks of process memory, including API keys, environment variables, and live chat data from users' conversations. The vulnerability, cataloged as CVE-2026-7482 and carrying a CVSS score of 9.1, is being called "Bleeding Llama" by researchers at Cyera. It affects an estimated 300,000 servers worldwide running versions prior to 0.17.1.

The flaw lives in Ollama's model loader, specifically in how it handles GGUF files - the format used to package large language models for local execution. When a user creates a model via the /api/create endpoint, the server reads past its allocated memory buffer if the uploaded GGUF file declares tensor offsets and sizes that exceed the file's actual length. This out-of-bounds heap read can then leak sensitive data into the resulting model artifact, which an attacker can exfiltrate by pushing it to a registry they control via the /api/push endpoint.

"An attacker can learn basically anything about the organization from your AI inference - API keys, proprietary code, customer contracts," said Cyera researcher Dor Attias. He noted that engineers often connect tools like Claude Code to Ollama, meaning tool outputs flow to the server's heap and could be stolen.

Separately, researchers at Striga disclosed two unpatched flaws in Ollama's Windows update mechanism that chain into persistent code execution. CVE-2026-42248 and CVE-2026-42249 (both CVSS 7.7) involve a missing signature check and a path traversal bug. An attacker who controls the update server can write arbitrary executables to the Windows Startup folder, ensuring code runs silently at every login. Versions 0.12.10 through 0.22.0 are vulnerable.

Ollama's REST API ships with no authentication, so organizations should immediately deploy an authentication proxy or API gateway, restrict network access, and apply the latest fixes. For Windows users, turning off automatic updates and removing the Startup folder shortcut can break the persistence chain until official patches arrive.

Source: The Hackers News