{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0423",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Ollama honeypots received sustained enumeration and model probes",
  "details": "## What\n\nGreyNoise recorded sustained sessions against Ollama honeypots and enumeration of more than 73 LLM endpoints. The observation demonstrates active reconnaissance and feeds the exposed-Ollama incident row; it is not a count of compromised machines or a claim that every request led to model access.\n\n## Which configuration is exposed\n\nThe exposed configuration is Ollama with OLLAMA_HOST set, making the API potentially reachable beyond loopback. The lock does not know whether a firewall or proxy blocks the service, so the finding is a review signal for a network boundary rather than a live scan result.\n\n## How ACVE detects it\n\nACVE checks the Ollama harness and the environment-presence feature. It records only that the variable was set, not its value. Missing feature data produces possible rather than clean.\n\n## Fix\n\nBind Ollama to loopback, require authentication for intentional remote access, and review request logs for enumeration. Rotate any credentials available to processes that served models on a public endpoint.\n\n## Grounding needed\n\nGreyNoise should be checked for the session windows and methodology. The reported session counts remain telemetry and are not converted into victim numbers.\n\nThis record is limited to the condition named in the public source: Ollama honeypots received sustained enumeration and model probes. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "ollama"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "exposed-surface"
      ],
      "cwe": [
        "CWE-306"
      ],
      "exploitation": {
        "status": "weaponised-poc",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://www.greynoise.io/blog/threat-actors-actively-targeting-llms",
            "type": "vendor"
          }
        ],
        "kev": {
          "listed": false
        },
        "victims": {
          "range": "91,403 sessions; 80,469-session enumeration dataset",
          "sectors": [
            "technology"
          ],
          "evidence": "GreyNoise honeypots recorded repeated enumeration against exposed Ollama and OpenAI-compatible endpoints."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "exposed-surface",
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "ollama"
          },
          {
            "field": "features[\"OLLAMA_HOST.set\"]",
            "op": "eq",
            "value": true
          }
        ]
      },
      "fix": {
        "summary": "Keep Ollama on loopback or behind an authenticated proxy.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "OLLAMA_HOST",
            "to": "127.0.0.1",
            "why": "Remove unauthenticated exposure."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:35Z",
          "sources": [
            {
              "url": "https://www.greynoise.io/blog/threat-actors-actively-targeting-llms",
              "status": 200,
              "contentType": "text/html; charset=utf-8",
              "sha256": "sha256:4f5b5068b07d6be14fd6cf8e66879385cdf257f0721491c5d995d04a8b029cfd",
              "type": "vendor"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}