Is Ollama Safe? Privacy, Port 11434, Published Vulnerabilities and a Hardening Checklist

Is Ollama safe? For one person on one machine, yes. Ollama is MIT-licensed, runs models on your own hardware and listens only on 127.0.0.1 by default, and its privacy policy says it cannot see local prompts. The risks are specific: the API has no authentication, models tagged :cloud send prompts to Ollama's servers, and older versions have published vulnerabilities. Keep it updated and keep the port closed.

The question hides several different ones. Is the software trustworthy to install? Does it phone home? Is the local server safe on a laptop that joins public networks? Are the models safe? And is any of this still true when a company puts many people on one server? Each has a different answer, so this guide takes them in turn.

Our evidence is Ollama’s documentation, privacy policy and repository, the US National Vulnerability Database, CERT Polska’s advisories and research from Wiz and Cisco Talos, all consulted on 14 November 2026. The current Ollama release that day was v0.40.16, published on 9 November.

Is Ollama safe to use? The short version by scenario

Is Ollama safe to install and download?

Ollama is open-source software from Ollama Inc. The code is public on GitHub under the MIT licence, with about 187,000 stars when we checked, and the company publishes a security policy that asks for private reports through GitHub advisories.

Download source. Use ollama.com/download or the project’s GitHub releases. Avoid repackaged installers from other sites.

Windows. Ollama’s documentation says the installer does not require Administrator rights and installs into your home directory. The app downloads updates automatically and applies them on restart.

macOS. The app also updates itself automatically.

Linux. The documented install is curl -fsSL https://ollama.com/install.sh | sh, and updating means running it again. Piping a script into a shell is common but worth reading first on a managed machine. The documentation’s manual route creates a dedicated ollama user and a systemd service, which is the better pattern for a server.

The Windows updater advisories. On 29 April 2026, CERT Polska published CVE-2026-42248 and CVE-2026-42249 for Ollama on Windows. The first says the app did not verify the integrity or signature of downloaded update executables; the second says a path built from HTTP response headers allowed files to be written outside the update folder, for example into the Startup folder. An attacker would need to influence the update responses, for instance from a position on the network. CERT Polska tested versions 0.12.10 to 0.17.5, named no fixed version and said the maintainers had not supplied details. We did not find a release note describing a fix, so on Windows keep the app current and update on networks you trust.

Is Ollama safe and private? What stays on your machine

Ollama’s privacy policy, last updated March 2026, is direct on the main point: Ollama runs on your local device, and the company does not collect, store, transmit or have access to prompts, responses or other content you process locally.

That does not mean the software never uses the network. Based on the policy and documentation:

So the honest answer to whether Ollama sends data is: metadata and downloads, yes; the content of local conversations, no, according to its policy. The documentation we read describes no switch for that metadata, so an environment that needs to be sure should block outbound traffic at the firewall and pull models through a controlled process. Once a model is on disk, local inference works without a connection.

The cloud exception: when Ollama is not local

Since September 2025 Ollama has also run a hosted service. A model name ending in :cloud, such as gemma4:cloud, tells your local Ollama to send the request to Ollama’s servers. It looks the same in the app, the CLI and the local API, and tools pointed at localhost:11434 cannot tell the difference. Several large models exist in Ollama’s library only as cloud tags.

Ollama says cloud prompts are processed transiently, not stored or logged and never used for training, with hosting primarily in the United States. That is a reasonable policy for a hosted service, but it is not local inference, and it is easy to select by accident. Our Ollama Cloud guide covers the plans, the API and the data terms in detail.

If your reason for using Ollama is that prompts must stay on the device, turn the cloud features off. Either add this to ~/.ollama/server.json:

{
  "disable_ollama_cloud": true
}

or set the environment variable OLLAMA_NO_CLOUD=1, then restart. Ollama’s log shows Ollama cloud disabled: true, and cloud models and web search stop working.

The API on port 11434 has no authentication

Ollama’s documentation states it plainly: the local API at http://localhost:11434 does not require authentication. API keys exist only for Ollama’s hosted service. Anyone who can reach the port can chat with models, pull new ones, delete existing ones and create models from files.

The default protects you: Ollama binds to 127.0.0.1, so only the same computer can connect. Three common changes remove that protection.

• OLLAMA_HOST=0.0.0.0. The documented way to let other machines connect. It opens the API to every network the computer joins, including café and hotel Wi-Fi on a laptop.
• Docker port mapping. The documented command uses -p 11434:11434, which publishes the port on all host interfaces. Use -p 127.0.0.1:11434:11434 unless you mean to share it.
• Tunnels. The FAQ describes ngrok and Cloudflare Tunnel set-ups. Both put the unauthenticated API on a public URL unless you add access control yourself.

Browsers are a second path. Ollama accepts cross-origin requests from 127.0.0.1 and 0.0.0.0 by default, and OLLAMA_ORIGINS widens that. Add only the origins you need. A wildcard lets any web page you visit call your models.

What researchers found on exposed servers

• Wiz, June 2024. While disclosing the Probllama vulnerability, Wiz reported more than 1,000 exposed Ollama instances hosting models, some private, and noted that Ollama does not support authentication out of the box.
• Cisco Talos, September 2025. A Shodan study found 1,139 exposed Ollama servers. Of those, 214, about 19%, were hosting models and answering requests without authorisation. Talos recommended authentication, network restriction, rate limiting and continuous monitoring for exposed endpoints.

Larger counts have been reported since, including a widely cited SentinelLABS and Censys study from January 2026. We could not retrieve that report directly on the day we checked, so we do not quote its figures.

Published Ollama vulnerabilities, with dates

A keyword search for Ollama in the US National Vulnerability Database returned 46 entries on 14 November 2026, covering Ollama itself and other products that integrate it. The ones below affect Ollama directly and show the pattern. Fixed versions are as stated in the NVD entry or the linked advisory; several 2026 entries were still awaiting NVD analysis.

Three lessons follow from the list.

Most of these need network access to the API. The NVD text for CVE-2026-7482 notes that the affected endpoints have no authentication and that the OLLAMA_HOST=0.0.0.0 configuration is widely used. A server on 127.0.0.1 is out of reach for a remote attacker in most of these cases. CVE-2024-28224 is the exception that shows why updates still matter on a laptop: it worked through the browser.

Model files and registries are an attack surface. Several entries involve a crafted GGUF file or a malicious registry response. Pull from sources you trust.

Staying current is the main defence. Every entry with a stated fix was fixed in a version older than v0.40.16. The entry marked through 0.12.3 describes the unauthenticated design itself, which no update removes: keeping the port closed is the fix.

Ollama’s security policy asks users to update regularly, secure access to hosted instances and monitor for unusual activity.

Are Ollama models safe? Provenance, templates and licences

Ollama the program and the models it runs are separate questions.

Who published it. The Ollama library holds models packaged under the vendor’s name, such as gemma4 or gpt-oss. Any user can also push a model under their own namespace with ollama push myuser/mymodel, and others can pull it. Those community uploads are not reviewed. Models can also be imported from GGUF or Safetensors files obtained elsewhere.

What a model file can do. A GGUF file holds weights and metadata, not a program, which is safer than older formats that could execute code on load. It is still parsed by the server, and the vulnerability list shows crafted files crashing Ollama or reading memory in older versions.

What rides along with the weights. An Ollama model bundles a TEMPLATE, an optional SYSTEM prompt and PARAMETER settings from its Modelfile. A publisher can set a system prompt that steers answers in ways you would not expect. Inspect it before use:

ollama show --modelfile gemma4
ollama show gemma4

Behaviour. A model can only produce text, but if an agent acts on that text, running commands or calling tools, a poorly tested or deliberately altered model becomes a real risk. The CVE in Ollama’s experimental agent mode is a reminder. Our prompt injection prevention guide covers the controls.

Licence. Ollama’s MIT licence covers the software only. Each model has its own licence, shown by ollama show and carried in the Modelfile’s LICENSE field. Some permit commercial use freely, others restrict it.

Where the model comes from matters more for some families than others. Our review of whether DeepSeek’s open weights are safe to run works through one example, and the model supply chain guide describes how an organisation should approve and pin model files.

Ollama hardening checklist

1. Update. Run a current version; on 14 November 2026 that was v0.40.16.

2. Confirm the bind address. The listener should be 127.0.0.1:11434:

   # Linux
   ss -ltnp | grep 11434
   # macOS
   lsof -iTCP:11434 -sTCP:LISTEN

   # Windows
   netstat -ano | findstr 11434

3. Test from another machine. curl http://<your-ip>:11434/api/tags should fail to connect.

4. Unset OLLAMA_HOST unless you have a reason, and firewall port 11434 on laptops.

5. Fix Docker mappings. Use -p 127.0.0.1:11434:11434, and do not give the container more host access than it needs.

6. Keep OLLAMA_ORIGINS narrow. No wildcards.

7. Disable cloud features with OLLAMA_NO_CLOUD=1 where prompts must stay local.

8. Pull from the official library, inspect Modelfiles, and record which model versions you approved.

9. Do not sign in on shared servers unless you need cloud models or private pulls.

10. If others need access, add a gatekeeper. An authenticating reverse proxy or a VPN, with TLS, in front of a server that still listens on localhost.

11. Be careful with agent features. Tools that let a model run shell commands deserve a sandbox and manual approval.

12. Block outbound traffic on sensitive hosts and bring models in through a reviewed path, as in our air-gapped deployment guide.

Is Ollama safe for a company? Identity, audit and model policy

Everything above assumes one person. A company usually wants one GPU server that many people use, and Ollama’s design does not cover that on its own.

• No identities. The API has no users, so there is nothing to grant, revoke or attribute. A reverse proxy can add a shared password or single sign-on, but Ollama still sees one anonymous caller.
• No audit record. There is no log of who asked what, which regulated teams need.
• No model policy. Any caller can pull any model, including cloud tags, unless you disable them.
• Shared memory. CVE-2026-7482 was notable because leaked memory could contain other users’ conversations.
• Unmanaged installs. Ollama on staff laptops, with whatever models each person pulled, is a form of shadow AI even when nothing leaves the building.

None of this makes Ollama a poor choice for a team; it means the controls have to come from the layers around it. Our guide to putting several users on one Ollama server covers the reverse proxy, a chat front end with accounts, and capacity.

How VDF AI fits

Ollama answers the question of how to run a model. An organisation also has to answer who may use which model with which data, and how to show that afterwards. VDF AI does not ship, host or resell Ollama. It is an on-premises and private-cloud platform that provides chat, private RAG and governed agents on top of models you serve yourself, with role-based access control and audit logs on every plan and Microsoft Entra ID single sign-on for on-premises deployments.

At the model layer, VDF AI Router can register an Ollama server you operate as an on-premises model source next to the cloud models your policy approves. It applies allow and deny lists before each call, and its air-gap mode keeps routing on local models only. That supports a narrow approval: specific models for specific workloads, with each routing decision returned with its reason.