Ollama: Critical ‘Bleeding Llama’ flaw leaks API keys and user data from inference servers

Security researchers disclosed CVE-2026-7482, a critical heap out-of-bounds read vulnerability (CVSS 9.9) in Ollama’s GGUF model loader, nicknamed ‘Bleeding Llama.’ An unauthenticated attacker could submit a crafted GGUF file to the /api/create endpoint to make the server read past its heap buffer, then exfiltrate the leaked memory — including API keys, system prompts, and other users’ conversations — via the /api/push endpoint. An estimated 300,000 internet-exposed Ollama servers were at risk before a fix shipped in version 0.17.1.