CVE-2026-103663: Ollama Path Traversal Vulnerability

CVE-2026-103663 Overview

CVE-2026-103663 is a path traversal vulnerability [CWE-23] in Ollama's /api/pull endpoint. The digestToPath function fails to validate layer digests, allowing an unauthenticated remote attacker to supply traversal sequences as a digest value. The server then writes attacker-controlled content outside the model store.

When the Ollama server has write access to /usr/lib/ollama, the default in most Ollama Docker images, an attacker can plant a malicious binary there. On the next server restart, Ollama loads and executes the file, producing remote code execution as root. The maintainers fixed the issue in version 0.35.0.

Critical Impact

Unauthenticated attackers can achieve remote code execution as root on default Ollama Docker deployments by chaining path traversal with library loading on restart.

Affected Products

• Ollama versions prior to 0.35.0
• Ollama Docker images using default /usr/lib/ollama write permissions
• Any Ollama deployment exposing the /api/pull endpoint to untrusted networks

Discovery Timeline

• 2026-10-08 - CVE-2026-103663 published to NVD
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-103663

Vulnerability Analysis

Ollama processes model pulls through its HTTP /api/pull endpoint. During a pull, the server resolves each layer digest to a filesystem path using the digestToPath function. This function treats the digest string as trusted input and concatenates it into a path without sanitization.

An attacker crafts a manifest where a layer digest contains traversal sequences such as ../../../usr/lib/ollama/malicious.so. The server writes the downloaded layer content to the resolved location. Because the write operation inherits the server process permissions, any directory writable by Ollama becomes a drop target.

The second stage of the attack relies on Ollama's startup behavior. Shared libraries placed in /usr/lib/ollama are loaded on process start. A planted binary executes with root privileges on the next container restart, completing the chain from unauthenticated request to root RCE.

Root Cause

The digestToPath function lacks validation that the resulting path stays within the model store directory. Expected digests follow a fixed algorithm:hex format, but the function does not enforce this shape. The flaw matches CWE-23: Relative Path Traversal.

Attack Vector

Exploitation requires network reachability to the Ollama HTTP API and no authentication. The attacker hosts a malicious model manifest, then triggers /api/pull to fetch it. The server parses the manifest, resolves the attacker-controlled digest, and writes layer bytes to the chosen filesystem location. Persistence and code execution complete when the service restarts and loads the planted file.

Technical details are documented in the CERT.PL advisory for CVE-2026-103663.

Detection Methods for CVE-2026-103663

Indicators of Compromise

• Files written outside the Ollama model store, particularly new or modified binaries under /usr/lib/ollama
• HTTP requests to /api/pull containing .., %2e%2e, or path separators within digest fields
• Outbound connections from the Ollama process to attacker-controlled model registries
• Unexpected shared libraries loaded by the Ollama process at startup

Detection Strategies

• Inspect reverse proxy and application logs for /api/pull requests with malformed digest values that do not match the sha256:[0-9a-f]{64} pattern
• Monitor filesystem writes by the Ollama service user to directories outside the configured model store
• Alert on Ollama process restarts followed by loading of shared objects not shipped with the official release

Monitoring Recommendations

• Enable audit logging for file create and write operations under /usr/lib/ollama and other Ollama-writable directories
• Capture full HTTP request bodies to /api/pull for forensic review when the endpoint is exposed internally
• Track container image digests to detect drift from the vendor-published baseline

How to Mitigate CVE-2026-103663

Immediate Actions Required

• Upgrade Ollama to version 0.35.0 or later across all hosts and container images
• Remove direct internet exposure of the Ollama API and place it behind an authenticating reverse proxy
• Audit /usr/lib/ollama and the model store for files that do not match expected digests or vendor artifacts
• Rotate credentials and keys accessible to the Ollama service account if compromise is suspected

Patch Information

Ollama resolved CVE-2026-103663 in version 0.35.0. The fix validates layer digests in digestToPath so that paths cannot escape the model store. Refer to the Ollama project for release downloads and the CERT.PL advisory for background on the fix.

Workarounds

• Run the Ollama process as a non-root user with no write access to /usr/lib/ollama or other library load paths
• Mount /usr/lib/ollama read-only inside Docker containers using the --read-only or volume ro flag
• Restrict /api/pull to trusted clients using network ACLs or an authenticating gateway until patching completes
• Enforce egress filtering so the Ollama service can only fetch models from approved registries

# Example: run Ollama container with read-only library path and non-root user
docker run -d \
  --name ollama \
  --user 1000:1000 \
  --read-only \
  --tmpfs /tmp \
  -v ollama-models:/root/.ollama \
  -v /usr/lib/ollama:/usr/lib/ollama:ro \
  -p 127.0.0.1:11434:11434 \
  ollama/ollama:0.35.0