CVE-2026-111702: Ollama IDOR exposes other users'

CISO Take

ChatOllama, a self-hosted chat UI for Ollama models, has an insecure direct object reference (CWE-639) that lets an unauthenticated remote attacker read any user's private knowledge base simply by iterating sequential IDs through GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat. The CVSS is 7.5 (network, low complexity, no privileges, no user interaction, high confidentiality impact), so exploitation needs nothing more than a script and basic HTTP access. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template yet, but the technical write-ups and source-line references in the public advisories make a working exploit trivial to build. The package has 1,791 downstream dependents, a risk score of 84/100 and 38 other CVEs, which points to a weak security track record. Affected and patched version ranges are not published (the issue is described as present through commit 96c3ce5), so no fixed release can be cited. Inventory any ChatOllama deployments, take them off the internet or put them behind an authenticating reverse proxy or VPN, and review knowledge bases for sensitive documents. Check access logs for sequential ID enumeration and move to a fixed upstream commit as soon as one is available.

Sources:NVDATLASVulnCheck advisoryHackMD third-party advisoryGitHub (chat-ollama source references)

What is the risk?

High. The flaw is remotely exploitable with no authentication or user interaction and is low complexity. Impact is confined to confidentiality (no integrity or availability effect), but knowledge bases often hold internal documents, policies, contracts and customer data uploaded for RAG. Sequential IDs make full enumeration cheap. Exploitation likelihood is moderate to high for any internet-exposed instance, but there is no evidence of active exploitation, no KEV listing and no public exploit as of publication. Internal-only deployments carry lower risk, though any authenticated or network-adjacent user could still read other users' data.

How does the attack unfold?

Reconnaissance

Attacker locates an exposed ChatOllama instance and probes the knowledge base API endpoints.

AML.T0006

Initial Access and Enumeration

Attacker iterates sequential IDs against GET /api/knowledgebases/{id} with no authentication or ownership check to discover other users' knowledge bases.

AML.T0049

Data Retrieval

Attacker supplies victim knowledgebaseId values to POST /api/models/chat so the RAG pipeline returns private document content.

AML.T0085.000

Impact

Sensitive corporate or personal documents are exfiltrated, causing confidentiality loss and potential regulatory exposure.

AML.T0025

Reconnaissance

Attacker locates an exposed ChatOllama instance and probes the knowledge base API endpoints.

AML.T0006

Initial Access and Enumeration

Attacker iterates sequential IDs against GET /api/knowledgebases/{id} with no authentication or ownership check to discover other users' knowledge bases.

AML.T0049

Data Retrieval

Attacker supplies victim knowledgebaseId values to POST /api/models/chat so the RAG pipeline returns private document content.

AML.T0085.000

Impact

Sensitive corporate or personal documents are exfiltrated, causing confidentiality loss and potential regulatory exposure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ollama	pip	—	No patch
184.7K1.8K dependentsPushed 7d ago19% patched~29d to patchFull package profile →

Do you use Ollama? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Identify all ChatOllama instances, including shadow-IT and developer deployments. 2) Upgrade to a fixed upstream commit or release that enforces ownership checks on knowledge base access, as soon as one is available. Affected and patched versions are not published, so check the vendor repository directly. 3) Until patched, remove public exposure and require authentication at a reverse proxy, VPN or zero-trust gateway. 4) Add a WAF or proxy rule to rate-limit and alert on sequential requests to /api/knowledgebases/{id} and on POST /api/models/chat with varying knowledgebaseId values. 5) Review access logs for enumeration patterns and for requests from unexpected IPs. 6) Audit knowledge base contents, remove unnecessary sensitive documents, and rotate any credentials or secrets that were ingested. 7) If a breach is plausible, follow data breach assessment and notification obligations (for example GDPR).

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassData ExtractionRAGAPIFrameworkAML.T0007- Discover AI Artifacts AML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0064- Gather RAG-Indexed Targets AML.T0085.000- RAG Databases

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-SuppliersA.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and negative impactsMAP 4.1-Approaches for mapping AI technology and legal risks of its components

OWASP LLM Top 10

LLM02:2025-Sensitive Information DisclosureLLM08:2025-Vector and Embedding Weaknesses

Frequently Asked Questions

What is CVE-2026-111702?

ChatOllama, a self-hosted chat UI for Ollama models, has an insecure direct object reference (CWE-639) that lets an unauthenticated remote attacker read any user's private knowledge base simply by iterating sequential IDs through GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat. The CVSS is 7.5 (network, low complexity, no privileges, no user interaction, high confidentiality impact), so exploitation needs nothing more than a script and basic HTTP access. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template yet, but the technical write-ups and source-line references in the public advisories make a working exploit trivial to build. The package has 1,791 downstream dependents, a risk score of 84/100 and 38 other CVEs, which points to a weak security track record. Affected and patched version ranges are not published (the issue is described as present through commit 96c3ce5), so no fixed release can be cited. Inventory any ChatOllama deployments, take them off the internet or put them behind an authenticating reverse proxy or VPN, and review knowledge bases for sensitive documents. Check access logs for sequential ID enumeration and move to a fixed upstream commit as soon as one is available.

Is CVE-2026-111702 actively exploited?

No confirmed active exploitation of CVE-2026-111702 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-111702?

1) Identify all ChatOllama instances, including shadow-IT and developer deployments. 2) Upgrade to a fixed upstream commit or release that enforces ownership checks on knowledge base access, as soon as one is available. Affected and patched versions are not published, so check the vendor repository directly. 3) Until patched, remove public exposure and require authentication at a reverse proxy, VPN or zero-trust gateway. 4) Add a WAF or proxy rule to rate-limit and alert on sequential requests to /api/knowledgebases/{id} and on POST /api/models/chat with varying knowledgebaseId values. 5) Review access logs for enumeration patterns and for requests from unexpected IPs. 6) Audit knowledge base contents, remove unnecessary sensitive documents, and rotate any credentials or secrets that were ingested. 7) If a breach is plausible, follow data breach assessment and notification obligations (for example GDPR).

What systems are affected by CVE-2026-111702?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, LLM chat interfaces, Self-hosted LLM inference front-ends, Multi-tenant knowledge base applications.

What is the CVSS score for CVE-2026-111702?

CVE-2026-111702 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesLLM chat interfacesSelf-hosted LLM inference front-endsMulti-tenant knowledge base applications

MITRE ATLAS Techniques

AML.T0007Discover AI Artifacts

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0064Gather RAG-Indexed Targets

AML.T0085.000RAG Databases

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3, A.7.4

NIST AI RMF: MANAGE 2.3, MAP 4.1

OWASP LLM Top 10: LLM02:2025, LLM08:2025

What are the technical details?

Original Advisory

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.

Exploitation Scenario

An attacker finds an internet-exposed ChatOllama instance through Shodan or a search for its default paths. They send GET /api/knowledgebases/1, /2, /3 and so on, and receive metadata for other users' knowledge bases with no ownership check. They then POST to /api/models/chat with each discovered knowledgebaseId and crafted queries such as 'summarize all documents' or 'list contract terms', so the RAG pipeline returns retrieved document content from the victim's private corpus. The whole process is scripted and exfiltrates internal policies, customer records or proprietary research without any credentials.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.