Digest · Saturday

Security digest: May 2, 2026

1 editorial brief.

All digests · RSS · Markdown

Take stock

Check exposure: Bleeding Llama. Anyone running Ollama older than 0.17.1 with port 11434 reachable from the internet, a shared LAN, or other tenants.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

May 2, 2026 · Vulnerability · CVE-2026-7482

Bleeding Llama: Unauthenticated Memory Leak in Ollama

A laptop running Ollama on its default localhost binding is not reachable; a server you exposed with OLLAMA_HOST=0.0.0.0 or a published Docker port is, and it should be updated and its secrets rotated.

Must act: Anyone running Ollama older than 0.17.1 with port 11434 reachable from the internet, a shared LAN, or other tenants.

Can relax: Desktop users on the default 127.0.0.1 binding who auto-update, and anyone already on 0.17.1 or later.

Check the version with ollama --version (or GET /api/version) and update to 0.17.1 or later
Find exposed instances: confirm port 11434 is not reachable from outside (ss -ltnp | grep 11434; external scan)
Bind to 127.0.0.1 or put an authenticating reverse proxy or API gateway in front; Ollama has no built-in auth

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.