CVE-2026-5757: Ollama unauthenticated heap memory

CISO Take

Ollama's model quantization engine contains an unauthenticated flaw that lets a remote attacker read raw heap memory from the inference server and exfiltrate whatever happens to be resident there — potentially cached prompts, completions, tokens, or other sensitive fragments. With no authentication, no user interaction, and low attack complexity required (CVSS 7.5), any internet-exposed Ollama instance is a viable target, and Ollama backs an estimated 1,631 downstream projects spanning local RAG pipelines and agent stacks. Exploitation likelihood currently sits at a middling EPSS percentile (top 58%), there's no public exploit or Nuclei template yet, and CISA's SSVC decision is TRACK — the lowest-urgency tier — so this isn't an active-exploitation emergency today. That said, Ollama already carries 26 other CVEs and a package risk score of 84/100, reflecting a track record of exploitable flaws including RCE modules available in Metasploit, so this disclosure adds to an already elevated risk profile. Action: check ollama.com and CERT/CC VU#518910 for a patched release, and in the meantime ensure Ollama's API (default port 11434) is never exposed directly to the internet.

Sources: NVD EPSS CISA KEV CERT/CC ollama.com ATLAS

What is the risk?

Confidentiality-only impact (C:H/I:N/A:N) via a network-exploitable, unauthenticated, zero-interaction path — technically trivial to reach even though no working exploit is public yet. Actual exploitation risk is moderate-to-low today: EPSS sits at just 0.55% (58th percentile), there's no CISA KEV listing, no Nuclei scanner template, and CISA's SSVC verdict is TRACK, the least urgent tier. However, Ollama is one of the most widely deployed local/self-hosted LLM inference engines (1,631 downstream dependents) and is frequently run without built-in authentication, meaning a meaningful population of internet-reachable instances likely exists today. Combined with the package's broader risk profile (26 other CVEs, package risk score 84/100, prior RCE issues with public Metasploit modules), this should be tracked and patched proactively rather than treated as background noise.

How does the attack unfold?

Unauthenticated Network Access

Attacker locates and reaches an internet-exposed Ollama instance without needing any credentials.

AML.T0049

Trigger Heap Over-read

Attacker sends a crafted request to the quantization engine, causing an out-of-bounds heap read.

Extract Leaked Memory

The server response includes raw heap contents, which the attacker parses offline for cached prompts, tokens, or configuration data.

AML.T0037

Secondary Compromise & Persistence

Attacker leverages any leaked secrets (API keys, credentials) for further compromise or repeats the leak periodically for stealthy, low-noise persistence.

Unauthenticated Network Access

Attacker locates and reaches an internet-exposed Ollama instance without needing any credentials.

AML.T0049

Trigger Heap Over-read

Attacker sends a crafted request to the quantization engine, causing an out-of-bounds heap read.

Extract Leaked Memory

The server response includes raw heap contents, which the attacker parses offline for cached prompts, tokens, or configuration data.

AML.T0037

Secondary Compromise & Persistence

Attacker leverages any leaked secrets (API keys, credentials) for further compromise or repeats the leak periodically for stealthy, low-noise persistence.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ollama	pip	—	No patch
178.1K 1.7K dependents Pushed yesterday 10% patched ~50d to patch Full package profile →

Do you use Ollama? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Check ollama.com's release notes and CERT/CC VU#518910 for the patched version and upgrade immediately once confirmed — a specific fixed version isn't yet reflected in this feed. Never expose the Ollama API (default 11434) directly to the internet; bind to localhost or place it behind an authenticated reverse proxy/VPN and restrict access via firewall rules. Where Ollama backs multi-tenant or shared services, monitor logs for anomalous or malformed requests to model-load/quantization endpoints. Given the package's history (26 prior CVEs, RCE modules available in Metasploit), treat Ollama deployments as needing regular re-scanning rather than a one-time patch-and-forget fix.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Privacy Violation Inference Model AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0069 - Discover LLM System Information

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI system security controls

NIST AI RMF

MEASURE 2.7 - AI System Security and Resilience Evaluated and Documented

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-5757?

Ollama's model quantization engine contains an unauthenticated flaw that lets a remote attacker read raw heap memory from the inference server and exfiltrate whatever happens to be resident there — potentially cached prompts, completions, tokens, or other sensitive fragments. With no authentication, no user interaction, and low attack complexity required (CVSS 7.5), any internet-exposed Ollama instance is a viable target, and Ollama backs an estimated 1,631 downstream projects spanning local RAG pipelines and agent stacks. Exploitation likelihood currently sits at a middling EPSS percentile (top 58%), there's no public exploit or Nuclei template yet, and CISA's SSVC decision is TRACK — the lowest-urgency tier — so this isn't an active-exploitation emergency today. That said, Ollama already carries 26 other CVEs and a package risk score of 84/100, reflecting a track record of exploitable flaws including RCE modules available in Metasploit, so this disclosure adds to an already elevated risk profile. Action: check ollama.com and CERT/CC VU#518910 for a patched release, and in the meantime ensure Ollama's API (default port 11434) is never exposed directly to the internet.

Is CVE-2026-5757 actively exploited?

No confirmed active exploitation of CVE-2026-5757 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-5757?

Check ollama.com's release notes and CERT/CC VU#518910 for the patched version and upgrade immediately once confirmed — a specific fixed version isn't yet reflected in this feed. Never expose the Ollama API (default 11434) directly to the internet; bind to localhost or place it behind an authenticated reverse proxy/VPN and restrict access via firewall rules. Where Ollama backs multi-tenant or shared services, monitor logs for anomalous or malformed requests to model-load/quantization endpoints. Given the package's history (26 prior CVEs, RCE modules available in Metasploit), treat Ollama deployments as needing regular re-scanning rather than a one-time patch-and-forget fix.

What systems are affected by CVE-2026-5757?

This vulnerability affects the following AI/ML architecture patterns: model serving, local LLM inference, RAG pipelines, agent frameworks.

What is the CVSS score for CVE-2026-5757?

CVE-2026-5757 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.55%.

What is the AI security impact?

Affected AI Architectures

model servinglocal LLM inferenceRAG pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0069 Discover LLM System Information

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially leading to sensitive data exposure, further compromise, and stealthy persistence.

Exploitation Scenario

An attacker scans public IP ranges for exposed Ollama instances — a common misconfiguration since Ollama ships without authentication by default. Finding one, they send a crafted request that triggers the quantization engine's parsing path, causing the server to return a chunk of adjacent heap memory instead of, or alongside, the expected response. The attacker parses this raw memory dump offline for anything usable — leaked prompts or completions from other users, API keys or tokens cached in process memory, or internal configuration details — and uses whatever surfaces to pivot into further compromise of the host or connected systems, potentially returning periodically to harvest fresh memory dumps for stealthy, low-noise persistence.