CVE-2026-103663criticalCode execution2026-10-08
CVE-2026-103663: Ollama /api/pull path traversal can lead to code execution as root
An unauthenticated attacker who can reach an Ollama server can use a crafted layer digest in /api/pull to write a file outside the model store. In most Docker images that means a file Ollama loads and runs as root on the next restart.
What it is
CERT Polska, which coordinated the disclosure: “Ollama is vulnerable to path traversal in the /api/pull endpoint due to insufficient validation of layer digests by the digestToPath function.”
If the server process can write to /usr/lib/ollama, which CERT Polska says is the default in most Ollama Docker images, the dropped file is loaded and executed on the next server restart, giving remote code execution as root.
No login is needed. Reported by Bartłomiej Dmitruk (striga.ai).
How to check
- CERT Polska lists versions from 0.34.2 as affected; the fix is in 0.35.0.
- Check whether your Ollama API port (11434 by default) is reachable from anywhere other than localhost.
How to fix
- Upgrade Ollama to 0.35.0 or later, and pull a fresh Docker image if you run it in a container.
- Don’t expose the Ollama API to the internet or untrusted networks; put it behind authentication or a firewall.
- If an exposed server ran an affected version, check /usr/lib/ollama for files you didn’t put there before restarting it.
ollama --version
# Docker: docker pull ollama/ollama:latestSources
More advisories for this tool