postgrok

ollama

Properties3
tagstool, local-llms, security
typeentity
statusseedling

2 min read

Ollama

The default runner for local models, the port at 11434, the thing people mean by “I run Llama on my machine.” It binds to 127.0.0.1 by default, and that default is the whole security story: one environment variable, OLLAMA_HOST=0.0.0.0, converts a personal setup into a public API, and Docker’s port publishing writes firewall rules that bypass the firewall configured on purpose. SentinelOne and Censys counted 175,000-odd of these hosts answering the internet unauthenticated over 293 days https://www.sentinelone.com/labs/silent-brothers-ollama-hosts-form-anonymous-ai-network-beyond-platform-guardrails/. See local-ai-threat-layers, sentinelone.

The 2026 vulnerability record, per 2026-10-21-youtube-kai-local-ai-privacy with primary links where this session had them. GGUF tensor-size trust allowed heap-memory reads below 0.17.1 (“Bleeding Llama”, Saarland researchers, May 2026; the primary for that name was not located this session and stands flagged), an unverified-signature Windows auto-updater 0.12.10 through 0.17.5, fixed in 0.23.3, a 2024 Wiz path traversal to RCE, a DNS-rebinding host-header check that is skipped whenever the server is bound to 0.0.0.0, patched 2024 with a 2025 desktop drive-by follow-up. Current as of mid-October 2026 per the video: 0.30.6. Nvidia’s NemoClaw wrapper was found in August 2026 configuring Ollama to bind 0.0.0.0 while its installer printed “Using Ollama on localhost,” the clearest illustration of layer four failing quietly. See hugging-face for the supply-chain side.

The reason Ollama carries the headline risk is popularity, not negligence. Every runner parsing the same GGUF files (LM Studio, llama.cpp server, vLLM, SGLang) shares the category problem. The fact the whole story turns on is the default binding. Out of the box, only your machine can talk to it, confirmed by SentinelOne as the intended setup.

Sources

Graph View

Backlinks