Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Ollama can let attackers run code as root

CVE-2026-103663 · published 5 days ago
Summary

The Ollama service can be tricked into writing a malicious program to system folders because it does not check the file path it receives. If the program can write to the Ollama installation folder, the malicious file will run automatically when the service restarts, giving an attacker full control of the server. Updating to Ollama version 0.35.0 or later stops this problem.

What to do
  • Update ollama ollama to version 0.35.0 or later.
Affected software
VendorProductAffected versions
ollama ollama < 0.35.0
Original advisory text
Path Traversal leading to Remote Code Execution in Ollama
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. 

Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root.


This issue was fixed in version 0.35.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-23Relative Path Traversal
CWE-913Improper Control of Dynamically-Managed Code Resources
Timeline
Published8 Oct 2026
Updated10 Oct 2026
First seen8 Oct 2026
Sources
CVE-2026-103663 · NVD
CVE-2026-103663 · MITRE
CVE-2026-103663 · OSV
Track software like this
Free during beta