2026-05-10 · 2026-Q2
Ollama "Bleeding Llama" Unauthenticated Memory Leak (CVE-2026-7482)
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Ollama before 0.17.1; more than 300,000 servers exposed online
Impact
A remote, unauthenticated out-of-bounds heap read leaks process memory, including environment variables, API keys, system prompts, and other users' conversation data, which can then be pushed out through the `/api/push` endpoint
Root cause
The `/api/create` endpoint processes attacker-supplied GGUF files whose declared tensor offset and size exceed the actual file length; during quantization the server reads past the heap buffer using unsafe Go pointer operations. Found by Cyera
CVE
Sources
Catalog
Cite this: AgentProv incident record: Ollama "Bleeding Llama" Unauthenticated Memory Leak (CVE-2026-7482) (2026-05-10). https://agentprov.com/incidents/2026-05-10-ollama-bleeding-llama-unauthenticated-memory-leak-cve-2026-7482
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run