Ollama: an unauthenticated pull leads to code execution as root

01What happened

CERT Polska published CVE-2026-103663 on October 8, 2026, having helped coordinate the disclosure. Bartłomiej Dmitruk of striga.ai reported the flaw. The GitHub Advisory Database records a CVSS 4.0 base score of 9.4 and lists the entry as unreviewed, with the version range and fix below.

02How it works

The /api/pull endpoint does not validate layer digests before the digestToPath function uses them, so a traversal sequence inside a digest sends a downloaded layer outside the model store. Where the server process can write to /usr/lib/ollama, which CERT Polska says is the default in most Ollama Docker images, the planted file is loaded and executed on the next restart, as root. Calling the endpoint needs no authentication.

03Who is affected

Ollama 0.34.2 up to 0.35.0 carries the flaw, per CERT Polska. Two conditions decide real exposure: whether an attacker can reach the Ollama API, and whether the server process can write to /usr/lib/ollama, which CERT Polska reports as the default in most of Ollama's Docker images.

04What to do

Update Ollama to 0.35.0 or later, the release CERT Polska lists as fixed. Keep the API off untrusted networks, since it accepts a pull without credentials. Removing the server's write access to /usr/lib/ollama takes away the step that turns the file write into execution.

Questions people ask

Which Ollama versions are affected by CVE-2026-103663?

Ollama versions 0.34.2 up to 0.35.0 are affected, according to CERT Polska's advisory. Ollama 0.35.0 carries the fix. Deployments built from Ollama's Docker images matter most here, because CERT Polska says the server process can write to /usr/lib/ollama by default in most of them, which is the condition that turns the file write into code execution as root.

Is CVE-2026-103663 fixed, and in which Ollama release?

Yes. Ollama 0.35.0 fixes CVE-2026-103663, and CERT Polska lists that release as the fixed version. The release notes for 0.35.0 do not mention the flaw, so the version number is the thing to check rather than the changelog. Servers still running 0.34.2 through the builds before 0.35.0 remain exposed to an unauthenticated pull.

Can CVE-2026-103663 be exploited without credentials?

No credentials are needed. CERT Polska describes an unauthenticated remote attacker supplying a traversal sequence as a layer digest to /api/pull. The CVSS 4.0 vector in the GitHub Advisory Database reports no privileges required and passive user interaction, which matches the server restart that executes the planted file. Reachability of the API is therefore the main exposure question.

How do I check whether my Ollama server is exposed to CVE-2026-103663?

Check the running Ollama version first, then whether the API is reachable from outside the host. CERT Polska's advisory covers 0.34.2 up to 0.35.0. Containers built on Ollama's Docker images deserve a second look, because the write target /usr/lib/ollama is writable by the server there, per CERT Polska, and a restart is enough to run the planted binary.

Sources 3 links, all fetched

1. 1cert.plCERT Polska Advisory
2. 2github.comGitHub Advisory
3. 3github.comOllama 0.35.0 Release