Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.

CVE-2026-85180 describes a Server-Side Request Forgery (SSRF) vulnerability in Ollama versions 0.30.0 through 0.33.2. The flaw exists in the blob download mechanism used when pulling tensor-layer models, where redirect destinations are not validated. An unauthenticated attacker who controls a malicious registry can serve a crafted tensor-layer manifest that causes the Ollama server to issue GET requests to arbitrary internal hosts. This can be exploited to reach cloud metadata endpoints such as AWS IMDSv1, potentially exposing sensitive credentials or internal network services. The vulnerability requires no authentication to exploit and affects the cross-host tensor blob redirect flow in the transfer/download component. A fix or workaround involves validating redirect destinations to ensure they remain within trusted hosts. The issue is tracked publicly on GitHub and has been detailed in a VulnCheck advisory.