CVE-2026-19334: NightTrek Ollama-mcp RCE Vulnerability

CVE-2026-19334 Overview

CVE-2026-19334 is a command injection vulnerability in NightTrek Ollama-mcp, an open-source Model Context Protocol (MCP) server for Ollama. The flaw exists in src/index.ts up to commit 80cf2e17cfc144963a475b619093a2d13c13dbc9. Attackers can manipulate the name, modelfile, source, or destination arguments to inject arbitrary commands into the underlying shell. Exploitation requires local access and low-privilege authentication. The project uses a rolling release model, so no fixed version is currently identified. The maintainer was notified through a GitHub issue but has not responded at the time of publication.

Critical Impact
Local, authenticated attackers can execute arbitrary operating system commands by supplying crafted arguments to MCP tool calls, compromising the confidentiality, integrity, and availability of the host running Ollama-mcp.

Affected Products

NightTrek Ollama-mcp (rolling release)
Builds up to and including commit 80cf2e17cfc144963a475b619093a2d13c13dbc9
The vulnerable code path resides in src/index.ts

Discovery Timeline

2026-08-09 - CVE-2026-19334 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19334

Vulnerability Analysis

Ollama-mcp exposes MCP tool endpoints that wrap the local Ollama command-line interface. When a client invokes tools such as model creation, copy, or push operations, the server passes user-controlled arguments into shell command construction inside src/index.ts. The parameters name, modelfile, source, and destination reach the shell without sufficient sanitization or argument-array separation. An authenticated local caller can append shell metacharacters (for example, ;, &&, |, backticks, or $()) to any of these fields and execute additional commands under the process identity of the MCP server. The Common Weakness Enumeration classification is [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).

Root Cause

The root cause is unsafe composition of shell command strings from untrusted MCP tool arguments. Rather than invoking ollama with a fixed argv array and validated parameters, the server concatenates user input into a command string that a shell interpreter subsequently parses. Any metacharacter in the argument value is treated as syntax by the shell.

Attack Vector

The attack requires local access with low privileges, typically another process or user on the host, or a co-located MCP client with permission to reach the server. No user interaction is required. The attacker sends a crafted MCP tool request containing shell metacharacters within the name, modelfile, source, or destination field. Because MCP servers are frequently launched by AI assistants and IDE integrations, prompt-driven abuse from a compromised or malicious model context can also trigger the injection.

No verified proof-of-concept code has been published. Technical details are tracked in the GitHub Issue Discussion and the VulDB Vulnerability Details.

Detection Methods for CVE-2026-19334

Indicators of Compromise

Child processes of the Ollama-mcp Node.js runtime that are not ollama or its expected helpers, particularly shells such as sh, bash, or cmd.exe.
Ollama-mcp process arguments or logs containing shell metacharacters (;, |, &&, backticks, $()) in the name, modelfile, source, or destination fields.
Unexpected outbound network connections initiated from the Ollama-mcp process context.

Detection Strategies

Endpoint detection and response rules that flag shells spawned as descendants of Node.js processes hosting MCP servers.
Command-line auditing that inspects arguments passed to ollama create, ollama cp, and ollama push for embedded shell syntax.
File integrity monitoring on src/index.ts and on Ollama model storage directories to identify tampering.

Monitoring Recommendations

Ingest process-creation and command-line telemetry from developer workstations and AI-tooling hosts into a central data lake for retroactive hunting.
Alert on MCP server processes writing to sensitive paths such as ~/.ssh, /etc, or scheduled task directories.
Correlate MCP tool invocations with subsequent process trees to surface argument-driven command execution.

How to Mitigate CVE-2026-19334

Immediate Actions Required

Stop running Ollama-mcp on any host that processes untrusted MCP requests until a patched build is available.
Restrict the local user accounts and MCP clients permitted to reach the server socket to trusted principals only.
Review shell history, MCP server logs, and process auditing records for suspicious name, modelfile, source, or destination values.

Patch Information

No vendor patch is available. The maintainer was notified through the GitHub Issue Discussion but has not responded. Because the project uses a rolling release, users must track the GitHub Project Repository directly for a remediation commit. Additional coordination details are available in the VulDB CVE Report.

Workarounds

Fork the repository and replace shell-string command execution with child_process.execFile or spawn using an argv array, so arguments cannot be reinterpreted by a shell.
Add strict input validation that rejects any name, modelfile, source, or destination value containing characters outside a safe allow-list (for example, [A-Za-z0-9._:/-]).
Run the MCP server as a dedicated unprivileged user inside a container or sandbox that blocks outbound network access and restricts filesystem writes.

bash

# Configuration example: run Ollama-mcp under a restricted user with no shell
sudo useradd --system --shell /usr/sbin/nologin ollama-mcp
sudo -u ollama-mcp env PATH=/usr/local/bin:/usr/bin \
    node /opt/ollama-mcp/build/index.js