On 8 October 2026, CERT Polska disclosed CVE-2026-103663, a path traversal in Ollama's /api/pull endpoint that lets an unauthenticated attacker write a file outside the model store. In most Ollama Docker images that file can land in /usr/lib/ollama, where it is loaded on the next restart, giving code execution as root. The fix is in Ollama 0.35.0.
It is the most serious of several Ollama CVEs published since early September. Two of the others also go through the pull path, and one breaks the approval check in Ollama's experimental agent mode.
What's affected
- CVE-2026-103663 (CVSS 4.0 9.4, critical).
digestToPathdoesn't validate layer digests enough, so a crafted digest escapes the model directory. CERT Polska says the issue was fixed in 0.35.0 and credits Bartłomiej Dmitruk of striga.ai. - CVE-2026-108836 (published 12 October). A server-side request forgery in the Pull API's model name validation, affecting Ollama up to 0.34.1. Fixed in 0.34.2.
- CVE-2026-85180 (published 3 September, CVSS 4.0 8.7). When pulling tensor-layer models, Ollama doesn't validate redirect destinations. An attacker who controls a registry can make the server send GET requests to internal hosts, including cloud metadata endpoints. VulnCheck lists 0.30.0 through 0.33.2 as affected.
- CVE-2026-102697 (published 29 September, CVSS 4.0 8.5). In the experimental agent mode, the Bash tool approval check didn't parse shell syntax properly. If prompt injection influences the model's output, an attacker can append semicolons or logical operators to an approved command and run more commands without approval. Affects 0.14.0 up to, not including, 0.31.2. Fixed in 0.31.2.
Upgrading to 0.35.0 or later covers the three issues that list a fixed version.
How to check if you're exposed
Check the version, locally or through the API:
ollama --version
curl -s http://127.0.0.1:11434/api/version
For containers:
docker ps --format '{{.Names}} {{.Image}}' | grep -i ollama
docker exec <container> ollama --version
docker exec <container> sh -c 'test -w /usr/lib/ollama && echo "lib dir writable"'
The second check matters for CVE-2026-103663. A writable /usr/lib/ollama is what turns a file write into root code execution on restart.
Then check who can reach the API. These pull bugs need a request to /api/pull, and the attacker for CVE-2026-103663 is described as unauthenticated and remote:
ss -ltnp | grep 11434
echo "$OLLAMA_HOST"
A listener on 0.0.0.0:11434 or a public IP means anyone on that network can send a pull request. Also check cloud security groups and Kubernetes services for port 11434 exposure.
What to do now
- Upgrade to Ollama 0.35.0 or later on servers, workstations and container images. Rebuild images that bake in an older binary.
- Restart after upgrading, then look in
/usr/lib/ollamaand the model store for files you didn't expect. CVE-2026-103663 plants a file that only runs at the next restart, so a planted file can outlive the upgrade. - Keep the API off untrusted networks. Bind to
127.0.0.1unless remote access is required, and put an authenticating reverse proxy in front when it is. - Don't pull from registries you don't control. CVE-2026-85180 and CVE-2026-108836 both start with the server fetching something an attacker chose.
- Block metadata access from inference hosts. Restrict egress to
169.254.169.254and internal admin ranges so SSRF has less to reach. - Treat agent mode as experimental. If you used it before 0.31.2, assume approved commands could have carried extra commands.
Why it matters
Local model servers started on laptops and moved into shared infrastructure. Many deployments still carry laptop assumptions: wide-open port, no auth, container running as root with a writable library directory. CVE-2026-103663 needs all of those to reach root RCE, and plenty of setups have all three.
The pull API is the recurring surface here. Three of the four CVEs covered here involve fetching a model, which means the "download a model" button is part of your attack surface, not just your supply chain.
The agent-mode bug is a separate lesson that keeps repeating across AI tools: approving a command by matching its prefix doesn't approve what the shell actually does with it.
Try it yourself
Pull your Ollama image and run it with the same user and volumes you use in production. Check the reported version and whether /usr/lib/ollama is writable by the server process. Then see how scanning container images catches outdated binaries like this before they ship.
Click through it at your own pace, or open it full screen.
Quick check
Why does CVE-2026-103663 need a restart to become code execution?
The traversal writes a file. CERT Polska says that if the file lands in /usr/lib/ollama, it is loaded and executed on the next server restart.
Which version should I run?
0.35.0 or later. It is the fix version CERT Polska gives for CVE-2026-103663, and it is past the fix versions for CVE-2026-108836 and CVE-2026-102697.
Is a laptop install with the default local binding at risk?
Much less. The pull bugs need someone to send requests to the API. A listener bound only to localhost limits that to processes on the same machine.
