Q: Who is affected? (Versions/Components)

📦 **Vendor**: Ollama. 📅 **Affected**: Versions **prior to 0.17.1**. 🧩 **Components**: `/api/create` endpoint (loading) & `/api/push` endpoint (exfiltration).

Q: What can hackers do? (Privileges/Data)

🕵️ **Hackers Can**: Read sensitive memory contents. 🗝️ **Data Stolen**: Env vars, API keys, system prompts, user conversations. 📤 **Exfil Method**: Upload crafted model to attacker-controlled registry via `/api/push`.

Q: Is exploitation threshold high? (Auth/Config)

⚠️ **Threshold**: LOW. 🔓 **Auth**: Default endpoints `/api/create` & `/api/push` have **NO authentication**. 🌐 **Config**: Often bound to `0.0.0.0` (public internet), not just `127.0.0.1`.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🚫 **Public Exp?**: No PoCs listed in data. 📉 **Risk**: However, simple crafted GGUF files can trigger it. Wild exploitation likely easy due to lack of auth & simple buffer logic.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check Ollama version (< 0.17.1). 2. Scan for public exposure of port 11434. 3. Monitor for unusual `/api/create` or `/api/push` requests from unknown IPs.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes! 📦 **Patch**: Version **0.17.1**. 🔗 **Ref**: PR #14406 ensures tensor size validity. Commit `88d57d0` fixes the issue. 🔄 **Action**: Upgrade immediately.

Q: What if no patch? (Workaround)

🛡️ **Workaround**: 1. **Bind to 127.0.0.1** only. 2. Implement **reverse proxy auth** (e.g., Nginx basic auth) for `/api/create` & `/api/push`. 3. Restrict network access.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 🚨 **Priority**: P1. CVSS **High** (AV:N, AC:L, PR:N, UI:N, C:H, A:H). Immediate patching required due to no-auth default config & sensitive data exposure.

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: Ollama < 0.17.1 has a **Heap Buffer Over-read** in GGUF model loading. 📉 **Consequences**: Memory leakage of env vars, API keys, prompts, and chat data.…

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **CWE**: CWE-125 (Out-of-bounds Read). 🔍 **Flaw**: The loader accepts GGUF files with **invalid tensor offsets/sizes** exceeding file length.…

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Vendor**: Ollama. 📅 **Affected**: Versions **prior to 0.17.1**. 🧩 **Components**: `/api/create` endpoint (loading) & `/api/push` endpoint (exfiltration).

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

🕵️ **Hackers Can**: Read sensitive memory contents. 🗝️ **Data Stolen**: Env vars, API keys, system prompts, user conversations. 📤 **Exfil Method**: Upload crafted model to attacker-controlled registry via `/api/push`.

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

⚠️ **Threshold**: LOW. 🔓 **Auth**: Default endpoints `/api/create` & `/api/push` have **NO authentication**. 🌐 **Config**: Often bound to `0.0.0.0` (public internet), not just `127.0.0.1`.

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🚫 **Public Exp?**: No PoCs listed in data. 📉 **Risk**: However, simple crafted GGUF files can trigger it. Wild exploitation likely easy due to lack of auth & simple buffer logic.

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Self-Check**: 1. Check Ollama version (< 0.17.1). 2. Scan for public exposure of port 11434. 3. Monitor for unusual `/api/create` or `/api/push` requests from unknown IPs.

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

✅ **Fixed**: Yes! 📦 **Patch**: Version **0.17.1**. 🔗 **Ref**: PR #14406 ensures tensor size validity. Commit `88d57d0` fixes the issue. 🔄 **Action**: Upgrade immediately.

Question 9

What if no patch? (Workaround)

Accepted Answer

🛡️ **Workaround**: 1. **Bind to 127.0.0.1** only. 2. Implement **reverse proxy auth** (e.g., Nginx basic auth) for `/api/create` & `/api/push`. 3. Restrict network access.

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔥 **Urgency**: CRITICAL. 🚨 **Priority**: P1. CVSS **High** (AV:N, AC:L, PR:N, UI:N, C:H, A:H). Immediate patching required due to no-auth default config & sensitive data exposure.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-7482 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring