ollama-security

Audit any Ollama server for the one misconfiguration that actually leaks compute and models — a public API bound with no authentication — and prove it live with an anonymous probe of /api/tags, /api/ps, /api/version, /api/generate and CORS reflection. Other checklists tell you what might be wrong; this fetches the bytes and shows you what is.

⚡ Run it in one line, no token, no install:

npx ollama-security --url http://your-host:11434

🤝 Want it done for you? Fixed-scope audit — $99 / 24h: I verify each finding live and send a written report with the exact config fixes.

$ npx ollama-security --url http://10.0.0.5:11434
2 critical, 4 high, 1 medium — 7 CONFIRMED via anonymous probe
  CRITICAL  /api/version    Ollama API reachable with no authentication (v0.5.1)
  CRITICAL  /api/pull       anonymous model push/pull reachable — model theft + RCE chain
  HIGH      /api/tags       full model inventory leaked — 11 models reachable
  HIGH      /api/ps         running models + VRAM exposed
  HIGH      CORS            Origin reflected → any website can drive your Ollama
  HIGH      /api/generate   anonymous inference accepted — free GPU / compute theft

Why this exists

Ollama is the default way to run local LLMs — and it ships with no authentication on port 11434 (CNVD-2025-04094). If OLLAMA_HOST is bound to 0.0.0.0 and the port is reachable, anyone who finds it has full control of your models and your GPU.

This is not theoretical. In February 2026, ~175,000 Ollama instances were found exposed with zero auth (LeakIX / the Cisco–Shodan study). The documented abuse is brutal: model theft via pull/push, free inference on your hardware, and proven RCE chains — in June 2026 Sysdig caught an attacker using an exposed Ollama as a malware brain.

ollama-security checks for these and confirms the real ones by issuing the exact anonymous request an attacker would — so you triage facts, not maybes. If your server isn't anonymously reachable, it tells you so and exits clean.

What it checks

| Check | Severity | How it's confirmed | |---|---|---| | API reachable with no auth | critical | anonymous GET /api/version answers {version} | | Model push/pull write path open | critical | anonymous POST /api/pull accepted (not 401/403) | | Model inventory leak | high | anonymous GET /api/tags returns every model | | Running models / VRAM leak | high | anonymous GET /api/ps returns loaded models | | CORS reflects arbitrary Origin | high | a foreign Origin is echoed in Access-Control-Allow-Origin | | Free inference (compute theft) | high | anonymous POST /api/generate accepted | | Version disclosure | medium | /api/version reveals the exact build for CVE matching |

The write-path probes (/api/pull, /api/generate) are sent with empty/num_predict=1 payloads so the tool never downloads a model or runs a real workload — a 200 or 400 proves the endpoint is open; 401/403/404 means it's protected.

Usage

# Probe a live instance
npx ollama-security --url http://your-host:11434

# Bare host works too (defaults to http:// and port 11434)
npx ollama-security --url your-host

# Write a shareable HTML report
npx ollama-security --url http://your-host:11434 --html report.html

# Static only (no requests sent) — just list the checks
npx ollama-security --url http://your-host:11434 --no-probe

Output is JSON on stdout (pipe it into CI) and a one-line summary on stderr. Exit is non-zero only on usage errors — gate your pipeline on the JSON summary.

The fix, in one line

# bind Ollama to localhost only, then firewall 11434 / front it with an authed proxy
export OLLAMA_HOST=127.0.0.1
# and never set OLLAMA_ORIGINS=* on a public box

Install (optional)

npm i -g ollama-security
ollama-security --url http://your-host:11434

Zero dependencies. Your data and credentials never leave your machine — every request goes straight from the tool to your Ollama server.

Sister tools

Same active-probe philosophy for the rest of the stack, all MIT:

supabase-security · pocketbase-security · firebase-security · appwrite-security · nhost-security · strapi-security · directus-security

License

MIT © Renzo Madueno