Ollama CVE-2026-103663

The arbitrary-file-write primitive requires only network reachability to the Ollama HTTP API /api/pull endpoint with no authentication (PR:N) against affected versions 0.34.2 through pre-0.35.0; the attacker supplies a path traversal sequence in the layer digest field. Escalation from file write to root RCE has two concrete limiting prerequisites: (1) the Ollama server process must have write access to /usr/lib/ollama, stated as the default in most Ollama Docker images but not guaranteed in non-Docker or hardened deployments, and (2) a subsequent server/container restart must occur to load and execute the planted binary. Defenders not running the default Docker image, running Ollama as a non-privileged user without write access to that directory, or not exposing the API to untrusted networks face substantially reduced real-world risk.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case, though the exploitation signals are more nuanced than the 9.4 score suggests. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) describes network-reachable, low-complexity, unauthenticated access, and the description confirms an unauthenticated remote attacker can trigger arbitrary file write via the /api/pull endpoint - the write primitive alone (path traversal via unvalidated layer digests, CWE-23) is directly and unconditionally exploitable. The escalation to root RCE, however, is conditional: it requires the server process to have write access to /usr/lib/ollama (stated as the default in most Ollama Docker images) AND a subsequent server restart to load/execute the planted file. The SSVC framework corroborates this split picture - Technical Impact: total (consistent with root RCE) but Exploitation: none and Automatable: no, meaning CISA sees no observed exploitation and the restart dependency prevents fully automated weaponization. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be assessed. There is no CISA KEV listing and no public exploit was identified in the provided data, so this is a serious latent risk (reported by CERT-PL, patched by vendor) rather than an actively-exploited emergency. Note one metric tension: the vendor vector sets UI:P (passive user interaction), which likely models the required server restart rather than attacker-independent victim action - verify interpretation with the vendor advisory.

An attacker with network access to an exposed Ollama instance (commonly a Docker container) sends a crafted /api/pull request whose layer digest encodes a path traversal sequence, causing digestToPath to write an attacker-supplied binary into /usr/lib/ollama outside the model store. When the container or service is next restarted, the planted file is loaded and executed, yielding remote code execution as root. Exploitation is unauthenticated and low-complexity per the CVSS vector, but no public proof-of-concept was identified at time of analysis and RCE depends on a restart occurring.