CVE-2026-108836

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.

• CWE-918

• https://github.com/aLtEr6/test.git
• https://github.com/aLtEr6/test/blob/main/test.pdf
• https://github.com/ollama/ollama/
• https://github.com/ollama/ollama/commit/dfabde4539e42ba1e1eab50a3a50b88aea7958a0
• https://github.com/ollama/ollama/pull/18512
• https://github.com/ollama/ollama/releases/tag/v0.34.2
• https://vuldb.com/cve/CVE-2026-108836
• https://vuldb.com/submit/972855
• https://vuldb.com/vuln/416610
• https://vuldb.com/vuln/416610/cti

Published

Oct 12, 2026

Last Modified

Oct 12, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108829A security flaw has been discovered in Zen Cart up to 2.2.2.…4.7
• CVE-2026-10883Type Confusion in ANGLE in Google Chrome prior to 149.0.7827…8.8
• CVE-2026-108830A weakness has been identified in meetecho janus-gateway up …4.2
• CVE-2026-108831A security vulnerability has been detected in meetecho janus…6.3
• CVE-2026-108834A vulnerability was detected in Cairo-dock Glx-Dock up to 3.…4.3
• CVE-2026-108835A flaw has been found in Yungengxin Yun Jia Security Guard u…4.4
• CVE-2026-108839thClaws through 0.141.0 contains a link-following vulnerabil…4.2
• CVE-2026-10884Use after free in Chromecast in Google Chrome prior to 149.0…8.3
• CVE-2026-10885Use after free in Chrome for iOS in Google Chrome on iOS pri…8.8
• CVE-2026-108850Company Research Agent through 2.2.0 contains a server-side …5.3
• CVE-2026-108851phpMyFAQ through 4.1.10 contains a missing authorization vul…3.3
• CVE-2026-108852Deep Chat through 2.5.1 contains a cross-site scripting vuln…4.7