A critical vulnerability in Ollama poses an immediate risk of sensitive information leakage for more than 300,000 servers exposed to the internet. The bug, tracked as CVE-2026-7482, is an out-of-bounds heap read in the model quantization pipeline of Ollama. Ollama is one of the most popular frameworks for running AI models on local hardware.
This bug also affects servers on local LANs if access is not restricted to them.
The vulnerability, dubbed Bleeding Llama by researchers Cyera, allows unauthenticated attackers to upload a specially crafted file to the Ollama API endpoint, causing the application to leak its process memory, including system prompts, user messages, environment variables, and other sensitive data.
See also: Attackers can exploit AI VLM models
Ollama provides an interface and a REST API server for running and invoking locally hosted large language models (LLMs). The application does not provide authentication by default and is often configured to “listen” on all network interfaces (0.0.0.0), even though it is intended for local use and connects to localhost (127.0.1.1) by default. There are approximately 300,000 Ollama serverscurrently exposed on the public internet and many more on local networks.
“With over 170,000 stars on GitHub and 100 million downloads on Docker Hub, Óllama is widely used in enterprises as a self-hosted AI inference engine,” Cyera warns, adding that the vulnerability is widely exploitable because no authentication is required.
Only three API requests to exploit
As we mentioned earlier, the vulnerability is located in Óllama's model quantization pipeline and is related to how the framework files GGUF , which store weights, metadata, and tokenizer information for local models.
“A malicious actor can craft a GGUF file that declares a much larger tensor size than the actual data provided, forcing Ollama to read far beyond the intended buffer boundary — gaining access to sensitive data stored in the heap,” the researchers said.
Leaked memory data can include user prompts and chat messages, system prompts from all running models, chat history from all users, API keys, tokens, and secrets stored in environment variables, proprietary code submitted to AI models, customer data and contracts examined by AI models, and so on.
See also: Gemini CLI: Critical vulnerability allowed supply chain attacks
After exploiting the vulnerability, attackers can send a request to the Óllama push API endpoint to export the model and embedded leaked data to a server under their control.
Mitigation
Users should update to version 0.17.1 of Οllama, which includes a fix for this vulnerability. In general, they should deploy an authentication proxy or API gateway on all Οllama instances and never expose them to the internet without IP access filters and firewalls.
“If the Ollama server was accessible from the internet, assume that environment variables and in-memory secrets may have been compromised,” Cyera said. “Change API keys, tokens, and credentials immediately.”
On local networks, Óllama servers should also be isolated in secure network segments and behind firewalls.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
This vulnerability highlights in the clearest way that the rapid adoption of artificial intelligence tools often precedes the necessary maturity in security issues. As platforms like Ollama are increasingly used in corporate and research environments, proper configuration, continuous updating and the implementation of strict protection mechanisms are no longer optional practices, but a basic requirement for secure operation.
See also: Fake Claude website distributes new “Beagle” malware
At the same time, the incident serves as a reminder that even tools designed for local use can become serious points of exposure when basic cybersecurity rules are neglected. Promptly upgrading, renewing credentials , and securing network access are critical actions, and this case will likely fuel the discussion around the need for more secure standards for developing and managing self-hosted AI systems in the future.
