CVE-2026-103663
Last modified
CVE-2026-103663 is a critical-severity vulnerability rated 9.4/10 on the CVSS scale. Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory.
Description
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. This issue was fixed in version 0.35.0.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Ollama | Ollama | >= 0.34.2, < 0.35.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-103663?
How severe is CVE-2026-103663?
How do I fix CVE-2026-103663?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-103649Missing network timeouts in the Linux builds of Progressive …7.5
- CVE-2026-103651MISP contains a vulnerability in its one-time password (OTP)…7.6
- CVE-2026-103655MISP contains a vulnerability in its two-factor authenticati…9.3
- CVE-2026-103656Rejected reason: this is rejected
- CVE-2026-103659MISP contains an authorization bypass in the event flattenin…7.1
- CVE-2026-103662MISP contains a reflected cross-site scripting (XSS) vulnera…5.1
- CVE-2026-103664MISP contains a reflected cross-site scripting (XSS) vulnera…4.8
- CVE-2026-103667Gitea's container registry served blob downloads with a `Con…5.4
- CVE-2026-103668An SQL Injection vulnerability exists in the Site Search fun…8.8
- CVE-2026-103670When a Gitea Actions run was inserted, older runs in the sam…7.5
- CVE-2026-103678A flaw was found in tnef. An attacker can exploit this vulne…8.1
- CVE-2026-103679A flaw was found in tnef. A remote attacker could exploit th…6.5
Are you affected by CVE-2026-103663?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST