CVE-2026-103663 Ollama CVE debrief

Who should care

System administrators and security teams responsible for Ollama deployments should assess exposure and prioritize remediation. This includes reviewing and updating Ollama to version 0.35.0 or later, restricting access to the /api/pull endpoint, and monitoring for suspicious activity on the Ollama server. Security teams should also consider compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-103663 is a path traversal vulnerability in Ollama that can lead to remote code execution. System administrators and security teams should assess exposure, prioritize remediation, and monitor for suspicious activity.

• Remote code execution as root on server restart
• Potential for malicious binary execution outside the model store
• Exposure of Ollama servers to unauthenticated remote attacks

Technical summary

A path traversal vulnerability exists in Ollama due to insufficient validation of layer digests by the digestToPath function. This can allow an unauthenticated remote attacker to write a malicious binary outside the model store, potentially leading to remote code execution as root on server restart. The vulnerability is particularly critical if the server process has write access to /usr/lib/ollama, the default in most Ollama Docker images. The issue was fixed in version 0.35.0, and system administrators should assess exposure and prioritize remediation.

Defensive priority

High

Recommended defensive actions

• Review and update Ollama to version 0.35.0 or later
• Restrict access to the /api/pull endpoint
• Monitor for suspicious activity on the Ollama server
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on a path traversal vulnerability in Ollama, which can lead to remote code execution. The vulnerability is due to insufficient validation of layer digests by the digestToPath function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.