Technical Advisory – Ollama DNS Rebinding Attack (CVE-2024-28224)

Ollama is an open-source system for running and managing large language models (LLMs).

NCC Group identified a DNS rebinding vulnerability in Ollama that permits attackers to access its API without authorization, and perform various malicious activities, such as exfiltrating sensitive file data from vulnerable systems.

access advisory api attack attackers authorization cve cve-2024 data dns file language language models large llms malicious ncc ncc group research running sensitive system systems technical technical advisories technical advisory vulnerability vulnerable