Reported by 2 outlets
Ollama "Bleeding Llama" (CVE-2026-7482) exposes 300,000 deployments to unauthenticated heap data theft
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Ollama "Bleeding Llama" (CVE-2026-7482) exposes 300,000 deployments to unauthenticated heap data theft
securityweek.com · 161d ago · May 6th, 2026
Cyera researchers have disclosed a critical heap out-of-bounds read vulnerability in Ollama, the open-source local LLM runtime, tracked as CVE-2026-7482 with a CVSS score of 9.3. The flaw exists in the GGUF model loader and is triggered by processing a malicious model file with declared tensor offsets exceeding the actual file size, causing the server to read past the allocated heap buffer. An attacker can then exfiltrate the resulting file — containing stolen heap data — to a remote server using Ollama's built-in model push feature. The entire attack requires only three unauthenticated API calls. Ollama's default configuration launches without authentication and listens on all interfaces, meaning approximately 300,000 internet-exposed deployments are immediately exploitable. Stolen heap data may contain environment variables, API keys, tokens, developer prompts, code, and PII/PHI. Organizations should update to Ollama 0.17.1, restrict network access with firewalls, and place authentication proxies in front of deployments. Any instance previously accessible from the internet should be treated as compromised.
-
update from cyera.com
Ollama "Bleeding Llama" — critical heap memory leak in AI inference server (CVE-2026-7482, CVSS 9.1) [TLDR InfoSec]
cyera.com · 154d ago · May 13th, 2026
An unauthenticated attacker uploads a crafted model via
/api/createwith an inflated tensor shape, triggers an OOB read during quantization, and exfiltrates the entire process heap via/api/push— all in 3 API calls with no authentication required in the default configuration (listens on 0.0.0.0). Leaked data includes user prompts, system prompts, API keys, environment variables, and all heap memory contents. The F16→F32 conversion is lossless, preserving heap data exactly. Ollama (170K+ GitHub stars, 100M+ Docker Hub downloads) is widely deployed as enterprise AI "chat" infrastructure. Fixed in v0.17.1.