ACVE-2026-0407

In the wild

exploited-itw · 2026-01-29 · vendor, dfir

Description

What

The reported Bizarre Bazaar operation targeted internet-facing Ollama and OpenAI-compatible endpoints. The campaign validated access and resold model access, while the broader Censys measurement counted 175,000 unique Ollama hosts across 130 countries. The exposure number is telemetry; the observed hijacking is the incident claim.

Which configuration is exposed

The exposed configuration sets OLLAMA_HOST so the service is reachable beyond loopback without an effective authentication proxy. A local Ollama installation that remains private does not match this condition, even when it runs the same model versions.

How ACVE detects it

ACVE checks the Ollama harness and OLLAMA_HOST.set feature discovered from environment names only. It does not scan ports or verify public reachability. Missing bind and authentication data produce possible findings and require an operator review.

Fix

Bind Ollama to loopback, or put an authenticated network proxy and allowlist in front of intentional remote access. Rotate credentials and review model access logs for unexpected pulls or generations. Do not treat a public banner count as proof that a particular host was compromised.

Grounding needed

The two cited pages should be rechecked for the operation dates and exposure methodology. Their counts disagree by method and time window, so this record keeps no fabricated exact victim total.

This record is limited to the condition named in the public source: Exposed Ollama endpoints were hijacked for LLM access resale. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

and
  harness.id eq "ollama"
  features["OLLAMA_HOST.set"] eq true

Fix

Bind Ollama to loopback or require an authenticated proxy.

• Reconfigure OLLAMA_HOST to 127.0.0.1. Keep the API private.
• Reconfigure surface to authenticated. Protect intentional remote service access.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.