Vulnerabilities

CVSS

6.6 Medium

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Risk score

52.8

Published

2024-04-08

Status

Published

Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

Weaknesses

CWE-346

Coverage 1

vulnerability

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

A vulnerability in NVIDIA NemoClaw allows an attacker to poison an AI model by serving a malicious webpage that can inject hidden instructions into every conversation. The vulnerability stems from a misconfigured Ollama…

The Hacker News · 5d ago High

CVE-2024-28224aimodel poisoningdns rebinding

All articles mentioning it

Advisories and references

• nccgroup.trust/us/our-research/?research=Technical+advisories
• github.com/ollama/ollama/releases
• research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebin...