T09 · Insecure Skill Coding Practices
- Location
docker-compose.yml:5- Finding
Unauthenticated Ollama API Exposed on All Host Interfaces
- Content
View full analysis
Vulnerability Details
File Location:
docker-compose.yml:5-6
Vulnerability Type: Unrestricted network service exposure
Risk Level: MediumVulnerable Code
yaml ports: - "11434:11434"Technical Analysis
Docker publishes this port on all host interfaces by default. The project documentation states that the local Ollama API does not require authentication. Consequently, running this Compose configuration on a host whose port 11434 is reachable from an untrusted network exposes the unauthenticated Ollama API to that network.
This exposure is unnecessary for the default local integration workflow, which only requires access through the loopback interface. The configuration therefore grants broader network access than the Skill's local-use case requires.
Attack Path
- A user starts the service with
docker compose up -d. - Docker binds host port 11434 to all available interfaces.
- An attacker identifies a host where TCP port 11434 is reachable.
- The attacker connects directly to the Ollama API without authentication.
- The attacker invokes exposed endpoints to enumerate models, submit inference workloads, or perform other operations supported by the installed Ollama version.
- Repeated or expensive requests consume host CPU, GPU, memory, and storage resources.
Exploitation depends on port 11434 being reachable through the host firewall or surrounding network controls.
Impact Assessment
An attacker can obtain unauthenticated network-level access to the Ollama service, but this finding alone does not establish host shell access. The practical scope includes unauthorized inference, service and model metadata exposure, compute-resource consumption, denial of service, and any additional unauthenticated model-management operations exposed by the deployed Ollama version.
- A user starts the service with
- Remediation
View remediation
Remediation Suggestions
Bind the published port to the loopback interface for the default local deployment:
yaml services: ollama: image: ollama/ollama container_name: ollama ports: - "127.0.0.1:11434:11434" volumes: - ollama:/root/.ollama restart: unless-stoppedIf remote access is required:
- Do not expose the backend port directly to untrusted networks.
- Place Ollama behind an authenticated TLS reverse proxy.
- Restrict source addresses with host and network firewalls.
- Apply request-size, concurrency, and rate limits.
- Separate administrative or model-management access from ordinary inference access where supported.
- Document explicitly that the default Ollama endpoint has no authentication and must not be internet-exposed.