Inference infrastructure

A vulnerability in Nvidia's NemoClaw, tracked as CVE-2026-65105, lets an attacker who lures a victim to a malicious website reach the local Ollama API through DNS rebinding. Because NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, Ollama's Host-header checks are skipped, giving unauthenticated access. The attacker can then modify the model's chat template to append persistent malicious instructions to agent system prompts.

Researchers disclosed CVE-2026-7482 (CVSS 9.1), a heap out-of-bounds read in the GGUF model loader of Ollama before 0.17.1, codenamed Bleeding Llama by Cyera. A remote, unauthenticated attacker can upload a crafted GGUF file with an inflated tensor shape to the /api/create endpoint, leaking process memory such as environment variables, API keys, system prompts and other users' conversation data, which can then be pushed to an attacker-controlled registry via /api/push. The flaw likely affects over 300,000 servers.

Cyera researchers disclosed CVE-2026-7482, dubbed Bleeding Llama, an out-of-bounds heap read in Ollama's model quantization pipeline triggered when GGUF files declare larger tensor sizes than their data. An unauthenticated attacker can upload a crafted file to the Ollama API endpoint and leak process memory, including system prompts, user messages and environment variables. The researchers estimate about 300,000 Ollama servers are exposed on the public internet.

Cyera reports that a heap out-of-bounds read in Ollama's GGUF model loader, tracked as CVE-2026-7482 (CVSS 9.3) and dubbed Bleeding Llama, can be exploited without authentication to read sensitive heap data such as prompts, messages and environment variables. An attacker supplies a GGUF file with a tensor offset and size larger than the file, then uses Ollama's model push feature to exfiltrate the result, requiring three unauthenticated API calls. Cyera estimates about 300,000 Ollama servers are exposed on the public internet.