Executive brief
Ollama, a tool for running large language models, is vulnerable to a flaw that could allow an attacker to steal a user's authentication tokens. By tricking a user into pulling a model from a malicious server, the attacker can redirect the authentication process to their own domain. This could lead to unauthorized access to private models or the ability to upload malicious models under the victim's identity.
Technical details
A vulnerability exists in the `server.auth.getAuthorizationToken` function within Ollama's model pulling mechanism. When the `/api/pull` endpoint interacts with a remote server that returns a 401 Unauthorized status, Ollama follows the URL provided in the `WWW-Authenticate` header's realm parameter without verifying if it matches the original request's domain. A remote attacker can host a malicious registry and provide a realm URL pointing to a legitimate service (like registry.ollama.ai), causing Ollama to send the user's valid authentication tokens to the attacker-controlled server. This allows for session hijacking and unauthorized access to private registry resources.
Affected products
- Ollama Ollama <= 0.9.6
Timeline
- 2024-12-24: disclosed: Original finding by FuzzingLabs reported via Huntr
- 2025-05-16: patched: Fix submitted via Pull Request #10750
- 2025-07-22: advisory: GitHub Advisory and CVE published