{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0407",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Exposed Ollama endpoints were hijacked for LLM access resale",
  "details": "## What\n\nThe reported Bizarre Bazaar operation targeted internet-facing Ollama and OpenAI-compatible endpoints. The campaign validated access and resold model access, while the broader Censys measurement counted 175,000 unique Ollama hosts across 130 countries. The exposure number is telemetry; the observed hijacking is the incident claim.\n\n## Which configuration is exposed\n\nThe exposed configuration sets OLLAMA_HOST so the service is reachable beyond loopback without an effective authentication proxy. A local Ollama installation that remains private does not match this condition, even when it runs the same model versions.\n\n## How ACVE detects it\n\nACVE checks the Ollama harness and OLLAMA_HOST.set feature discovered from environment names only. It does not scan ports or verify public reachability. Missing bind and authentication data produce possible findings and require an operator review.\n\n## Fix\n\nBind Ollama to loopback, or put an authenticated network proxy and allowlist in front of intentional remote access. Rotate credentials and review model access logs for unexpected pulls or generations. Do not treat a public banner count as proof that a particular host was compromised.\n\n## Grounding needed\n\nThe two cited pages should be rechecked for the operation dates and exposure methodology. Their counts disagree by method and time window, so this record keeps no fabricated exact victim total.\n\nThis record is limited to the condition named in the public source: Exposed Ollama endpoints were hijacked for LLM access resale. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "ollama"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "exposed-surface",
        "credential-theft"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://thehackernews.com/2026/01/researchers-find-175000-publicly.html",
            "type": "vendor"
          },
          {
            "url": "https://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/",
            "type": "dfir"
          }
        ],
        "kev": {
          "listed": false
        },
        "last_seen": "2026-01-29",
        "victims": {
          "range": "unverifiable",
          "sectors": [
            "technology"
          ],
          "evidence": "The sources describe hijacked exposed endpoints and an access-resale operation, but not a complete victim count."
        },
        "attribution": "Hecker / Sakuya / LiveGamer101"
      },
      "cveBoundary": "exposed-surface",
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "ollama"
          },
          {
            "field": "features[\"OLLAMA_HOST.set\"]",
            "op": "eq",
            "value": true
          }
        ]
      },
      "fix": {
        "summary": "Bind Ollama to loopback or require an authenticated proxy.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "OLLAMA_HOST",
            "to": "127.0.0.1",
            "why": "Keep the API private."
          },
          {
            "type": "reconfigure",
            "target": "surface",
            "to": "authenticated",
            "why": "Protect intentional remote service access."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:17:36Z",
          "sources": [
            {
              "url": "https://thehackernews.com/2026/01/researchers-find-175000-publicly.html",
              "status": 200,
              "contentType": "text/html; charset=UTF-8",
              "sha256": "sha256:54d38d3c79fd4073e378ae37fbc328cbd5370035a59ec9d467e3772e94db52ec",
              "type": "vendor"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}