Ollama: model-name validation flaw in the Pull API allows unauthenticated server-side request forgery

CVSS 5.5CVE-2026-108836AI/ML frameworks & servingcurated

Impact

Ollama's IsValid() check on model names lets a crafted name steer the pull path at a destination the operator did not intend, so an unauthenticated caller who can reach the Ollama HTTP API makes the server issue requests of its choosing. On a GPU node this is the inference daemon acting as a proxy into the node's own network position: cloud instance metadata, the management VLAN, internal registries and other tenants' service endpoints that are not reachable from outside. Ollama is routinely run with no authentication in front of it on the assumption that only the local tenant can reach it, which makes the exposure wider than the score suggests. The record reports confidentiality, integrity and availability impact as low and does not claim code execution.

Who can reach it

Anyone who can reach the Ollama API port. No authentication required; the exploit has been published.

What to do

Upgrade to Ollama 0.34.2 (commit dfabde4) and restart the Ollama service - a per-node daemon restart that drops in-flight generations but does not require draining or rebooting the node. Until then, keep the Ollama port bound to localhost or behind an authenticating proxy and block egress from inference nodes to metadata and management addresses.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-108836 https://github.com/ollama/ollama/commit/dfabde4539e42ba1e1eab50a3a50b88aea7958a0 https://github.com/ollama/ollama/pull/18512

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.