Ollama AI tool has default security vulnerabilities
China's cybersecurity authority warned that Ollama, an open-source large language model tool, has default configuration vulnerabilities that could allow unauthorized access, model theft, and data exfiltration. The vulnerabilities are particularly concerning for users who deploy Ollama privately without modifying default security settings.
What happened
On 3 March 2025, China's National Cybersecurity and Information Security Information Notification Center issued a warning that Ollama, an open-source cross-platform large language model tool, has default configuration vulnerabilities.
According to analysis by Tsinghua University's Network Space Topology Joint Research Center, Ollama lacks security authentication in default configuration, allowing unauthorized access and model theft. The tool does not set access controls by default, and unauthenticated users can call model services, obtain model information, delete model files, or steal data.
Reported impact
Users deploying Ollama privately with default configurations without changes face risks of data leakage, computational power theft, and service interruption. Attackers without authentication can access and manipulate models through interfaces such as /api/show to extract sensitive information, and can exploit previous vulnerabilities (CVE-2024-39720/39722/39719/39721) to cause data poisoning, parameter theft, and malicious file uploads.
Index analysis
Large numbers of vulnerable Ollama servers are reportedly exposed on the internet. The vulnerability is widespread because many users deploying DeepSeek and other large models use Ollama for private deployment without modifying default settings.
Governance controls
The center recommended users strengthen vulnerability screening and timely security hardening. It advised reporting network attacks to local public security cybersecurity departments and cooperating with authorities on investigation and disposal.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.