“Bleeding Llama” Explained: Is Your Local AI Exposed to the Internet? (60-Second Check)
CVE-2026-7482 let anyone on the internet read memory from ~300,000 Ollama servers—prompts, system instructions and API keys included. What happened, why “local” didn’t mean “private”, and a one-minute check you can run on your own machine today.
Awareness · 9 min
“Bleeding Llama” Explained
CVE-2026-7482 let anyone on the internet read memory from ~300,000 Ollama servers—prompts, system instructions and API keys included. What happened, why “local” didn’t mean “private”, and a one-minute check you can run on your own machine today.
Definition
“Bleeding Llama” (CVE-2026-7482, CVSS 9.1) is a memory-leak bug in Ollama’s model loader. A crafted GGUF file could make Ollama read and return chunks of its own memory to whoever sent it—no password needed. It was fixed in Ollama 0.17.1, but only servers reachable from the network could be attacked.
Most people run AI locally for one reason: so their prompts stay on their own machine. Bleeding Llama is a useful reminder that “local” describes where the model runs—not who can talk to it.
Researchers counted roughly 300,000 Ollama servers that answered to anyone on the internet. Many belonged to people who had no idea their laptop or home lab was open to the world.
This post is not a pile-on. Ollama fixed the bug quickly and it is a great project. The lesson applies to every local AI tool, including ours—so we will end with a check you can run in a minute, whatever you use.
What actually happened
Ollama has an API for creating and converting models. When it processed an uploaded GGUF file, it trusted the tensor sizes written inside the file instead of checking them against the data it actually had. A file that lied about its size made Ollama read far past the end of its buffer—straight into neighbouring memory.
That neighbouring memory could hold anything the server had recently touched: other users’ chat fragments, system prompts, and environment variables such as cloud keys and tokens. Three unauthenticated API calls were enough to collect it.
Timeline, as reported by the researchers and CVE record.
| Date (2026) | Event |
|---|---|
| Feb 2 | Cyera researcher Dor Attias reports the flaw to Ollama |
| Feb 25 | Fix ships in Ollama 0.17.1 |
| Apr 28 | CVE-2026-7482 assigned |
| May 1 | Public disclosure — ~300,000 internet-facing servers still unpatched |
note
The quiet-patch problem
The fix was available for months before the CVE was published. Anyone who didn’t update “because nothing was announced” stayed exposed. If you run any AI server, update on a schedule—not when headlines appear.
Why “local” didn’t mean “private”
A typical Ollama install only listens on your own computer (127.0.0.1). Nobody else can reach it. The trouble starts when people change that—usually for a good reason—and forget they did:
- Setting OLLAMA_HOST=0.0.0.0 so a phone, laptop or second PC on the Wi-Fi can use the GPU box.
- Running it in Docker with -p 11434:11434, which publishes the port on every network interface.
- Hosting it on a rented cloud GPU or VPS, where “every interface” means the public internet.
- Forwarding the port on a home router so it works “from anywhere”.
Each of those turns a private tool into a public, password-less API. A local AI server has no login by default because it was never designed to face strangers.
The same software, three very different risk levels.
| Setup | Who can reach it | Risk from bugs like Bleeding Llama |
|---|---|---|
| Listens on 127.0.0.1 only | Programs on your computer | Very low |
| Listens on 0.0.0.0 at home behind a router | Every device on your network | Medium — one infected device is enough |
| Listens on 0.0.0.0 on a VPS or with port forwarding | The whole internet | Critical — scanners find it within hours |
The 60-second check (works for any local AI tool)
Run one command and read one column. Common ports: Ollama uses 11434, LM Studio’s server 1234, and a hand-started llama.cpp server 8080.
Linux — list programs listening on the usual AI ports
ss -tlnp | grep -E ':(11434|1234|8080)\b'macOS
lsof -nP -iTCP -sTCP:LISTEN | grep -E ':(11434|1234|8080) 'Windows (Command Prompt or PowerShell)
netstat -ano | findstr "LISTENING" | findstr ":11434 :1234 :8080"How to read the result.
| You see | Meaning | Action |
|---|---|---|
| 127.0.0.1:11434 or [::1]:11434 | Only this computer can connect | You’re fine — just keep it updated |
| 0.0.0.0:11434, *:11434 or [::]:11434 | Every network this computer is on can connect | Fix it (next section) unless you truly need it |
| Nothing | No AI server is running right now | Run the check again while your tool is open |
Then check your version. For Ollama, anything below 0.17.1 is vulnerable to this specific bug:
ollama --versionIf you are exposed: fix it in this order
- Update first. For Ollama that means 0.17.1 or newer; for any other tool, the latest release.
- Bind to localhost. For Ollama, set OLLAMA_HOST=127.0.0.1 (or remove the 0.0.0.0 override) and restart it. In Docker, publish as -p 127.0.0.1:11434:11434.
- Close the router port forward if you made one.
- Need remote access? Use an SSH tunnel or a private mesh VPN instead of opening the port. If you must expose it, put a reverse proxy with real authentication in front.
- Rotate secrets. If an old version was exposed, assume any API key or token in that machine’s environment variables was readable. Revoke and reissue them.
Use a GPU box from your laptop without exposing any port (run on the laptop)
ssh -N -L 11434:127.0.0.1:11434 you@gpu-box.local
# Now http://127.0.0.1:11434 on your laptop reaches the GPU box, encrypted.The deeper lesson: model files are untrusted input
Bleeding Llama was triggered by a malicious model file. That is the part most people miss. We treat models like inert data, but software has to parse them—and parsers have bugs.
- Download models from publishers you recognise, not from look-alike accounts.
- Prefer formats that can’t carry code (GGUF and safetensors over pickle-based .bin/.pt files).
- Never accept model uploads from strangers on a server you care about.
tip
Go deeper
We wrote a separate guide on choosing safe model files and spotting fakes: “Is That Model File Safe?”—it covers pickle, safetensors, GGUF and what a checksum does (and doesn’t) prove.
How Quietly is set up to avoid this class of problem
We build Quietly as a desktop app, not a server, and we made a few deliberate choices because of incidents like this one:
Design choices relevant to Bleeding Llama.
| Risk | What Quietly does |
|---|---|
| Engine reachable from the network | Every engine Quietly starts (llama.cpp, FreeToken and the others) is launched bound to 127.0.0.1 only. There is no setting that publishes it to your network. |
| Strangers uploading models | There is no model-upload or model-push API. Models come from your own downloads or imports. |
| Tampered downloads | GGUF model downloads are checked against the sha256 Hugging Face publishes; engine binaries are pinned and checked against release digests. |
| Anything phoning out | Air-Gap Mode (Settings → Privacy) blocks every non-localhost request, and the Security Feed shows each one it blocked. |
warning
No software is bug-free—including ours
Binding to localhost shrinks who can attack you; it doesn’t make bugs impossible. Keep Quietly updated (the title bar shows when an update is ready) and run the 60-second check above now and then. Good security is boring habits, not a product.
Where Quietly fits
FAQ
Was every Ollama user affected by Bleeding Llama?
Only installs older than 0.17.1 that could be reached over a network. A default install that listens only on 127.0.0.1 could not be attacked from outside your computer. Updating to 0.17.1 or newer fixes the bug either way.
What could attackers steal?
Pieces of the server’s memory: recent prompts and replies, system prompts, and environment variables, which often include API keys and access tokens. If an exposed server ran an old version, rotate any secrets it had access to.
How do I know if my local AI is reachable from the internet?
Run the listening-ports check in this post. If the address is 127.0.0.1 or [::1], only your computer can connect. If it is 0.0.0.0, * or [::], other machines can, and you should bind it back to localhost or put authentication in front.
Is it safe to share my GPU box with my laptop?
Yes, if you use an SSH tunnel or a private VPN rather than opening the port. That way the AI server still listens only on localhost and the connection is encrypted and authenticated.
Does Quietly expose an API to my network?
No. Quietly starts its inference engines bound to 127.0.0.1 and has no model-upload API. With Air-Gap Mode on, it also blocks every outbound request that isn’t to localhost.
Sources
- Bleeding Llama: Critical Unauthenticated Memory Leak Hits 300,000 Ollama Servers — NYU Shanghai RITS
- Research note: Ollama “Bleeding Llama” CVE-2026-7482 and AI inference exposure — Cloud Security Alliance
- Exposed by Default: The Open LLM Infrastructure Attack Surface — Cloud Security Alliance
Related guides
Awareness
An AI Agent Deleted a Production Database in 9 Seconds. Here’s How to Stop Yours.
In April 2026 a coding agent found an API token, ran one command, and wiped a startup’s database and its backups. The model wasn’t the real problem. A plain-English look at agent “blast radius”, seven guardrails that would have stopped it, and how to set them up.
Awareness
A Malicious Repo Can Hijack Your AI Coding Agent: Prompt Injection Explained (and How Folder Trust Stops It)
In 2026, a GitHub issue title compromised about 4,000 developer machines, and Mozilla showed a repo with no malicious code that still opens a reverse shell through an AI agent. How indirect prompt injection works, the three doors it uses, and a safe routine for opening code you didn’t write.
Awareness
Is That Model File Safe? Pickle vs Safetensors vs GGUF, and How to Download AI Models Without Malware
Researchers have found 1,574 look-alike models on Hugging Face, and 2026 brought critical bugs triggered by poisoned GGUF files. Which model formats can carry code, how fake repos fool people, what a sha256 checksum does—and doesn’t—prove, and a six-point checklist before every download.