# Risk map — ollama/ollama

> Canonical page: https://codevetter.com/unpack/ollama/risk-map

# Risk map — ollama/ollama

Scanned commit 6383a0fa9cbf97494b847226e189f6e36b401a08 (2026-09-18). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Main risks: the API has no request authentication by default and can be bound to non-loopback hosts via OLLAMA_HOST; the server spawns subprocesses (llama-server, self runner, gpu probes) with model-derived arguments; startup blob pruning deletes on-disk data; registry push/pull signs with a local private key; and several middleware paths decompress/transform untrusted request bodies. Scheduler and runner state is intricate (eviction, OOM retry, panic on model mismatch during load).
- The REST API is unauthenticated; OLLAMA_HOST can bind it to 0.0.0.0 and OLLAMA_ORIGINS CORS allows wildcards/browser extensions, so any reachable origin can pull/delete/run models unless the operator restricts it (inferred) — [server/routes.go#L1858-L1890](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/routes.go#L1858-L1890) [envconfig/config.go#L85-L111](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/envconfig/config.go#L85-L111) [envconfig/config.go#L324](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/envconfig/config.go#L324)
- Subprocess attack surface: llama-server is exec'd with flags assembled from request/model options (num_ctx, -ngl, -t, chat templates); the runner binary path and env are constructed in startLlamaServer/SetupLlamaServerCommandEnv — [llm/llama_server.go#L400-L435](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/llm/llama_server.go#L400-L435) [llm/llama_server.go#L424](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/llm/llama_server.go#L424)
- Startup performs destructive maintenance: PruneLayers, manifest.PruneDirectory and fixBlobs delete blobs/manifests under OLLAMA_MODELS; guarded only by OLLAMA_NOPRUNE and a 1h grace period for fresh blobs — [server/routes.go#L1979-L2004](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/routes.go#L1979-L2004) [server/images.go#L37-L39](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/images.go#L37-L39) [manifest/paths.go#L74-L106](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/manifest/paths.go#L74-L106)
- Private signing key ~/.ollama/id_ed25519 (0600) is generated on first serve and used by auth.Sign for registry token exchange; realm host is checked against original host to avoid token leakage cross-origin — [cmd/cmd.go#L2119-L2163](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/cmd/cmd.go#L2119-L2163) [server/auth.go#L53-L62](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/auth.go#L53-L62)
- --insecure / registryOptions.Insecure permits plain-HTTP registry traffic (errInsecureProtocol exists but can be bypassed by request flag) — [server/images.go#L41-L61](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/images.go#L41-L61) [cmd/cmd.go#L2455](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/cmd/cmd.go#L2455)
- Request-body decompression is capped at 20MB (maxDecompressedBodySize) in the OpenAI middleware — a decompression-bomb guard; other endpoints bind JSON directly via gin ShouldBindJSON without explicit size limits — [middleware/openai.go#L24-L25](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/middleware/openai.go#L24-L25) [server/routes.go#L2473](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/routes.go#L2473)
- Scheduler contains a deliberate panic when the active load's ModelPath differs from the evicted-retry request — a crash-on-invariant-violation that takes down the whole server — [server/sched.go#L603-L611](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/sched.go#L603-L611)
- Secret hygiene in logs: filteredEnv redacts env values containing API/KEY/TOKEN/SECRET/PASSWORD/CREDENTIAL/AUTH before logging subprocess env, but only CUDA_/ROCR_/ROCM_/HIP_/HSA_/GGML_/PATH/LD_LIBRARY_PATH/DYLD_LIBRARY_PATH keys are logged at all — [llm/server.go#L21-L56](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/llm/server.go#L21-L56)
- Codex desktop proxy restricts to loopback requests (isLoopbackRequest) and websocket upgrades are special-cased; misconfiguration here would expose upstream proxying on the shared listener — [internal/proxy/codex_desktop.go#L645-L657](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/internal/proxy/codex_desktop.go#L645-L657) [server/routes.go#L1898-L1900](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/routes.go#L1898-L1900)
- Runner stream parsing bounds single response lines at 8MB (llamaServerStreamMaxBufferSize); unbounded growth in a misbehaving subprocess is otherwise handled only via HasExited/ping timeouts — [llm/server.go#L150-L154](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/llm/server.go#L150-L154)
- Legacy/removed features linger as explicit errors: LoRA adapters rejected (errAdaptersUnsupported), typical_p rejected, `useClient2` experiment warns-and-continues; dead flags like --experimental are hidden no-ops — [cmd/cmd.go#L292-L296](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/cmd/cmd.go#L292-L296) [cmd/cmd.go#L2431-L2433](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/cmd/cmd.go#L2431-L2433) [server/routes.go#L93](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/routes.go#L93) [server/routes.go#L2014-L2016](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/routes.go#L2014-L2016)
- Blast radius: a single Scheduler serializes all model loads (activeLoading) so a stuck subprocess load stalls every inference request; queue overflow surfaces as ErrMaxQueue (OLLAMA_MAX_QUEUE default 512) — [server/sched.go#L61-L89](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/server/sched.go#L61-L89) [envconfig/config.go#L281](https://github.com/ollama/ollama/blob/6383a0fa9cbf97494b847226e189f6e36b401a08/envconfig/config.go#L281)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)