CVE-2026-103663

Executive Summary

CVE-2026-103663 is a path traversal vulnerability in the Ollama large language model runtime, specifically in the /api/pull endpoint, caused by insufficient validation of layer digests in the digestToPath function. An unauthenticated remote attacker can supply a path traversal sequence as a layer digest to write arbitrary files outside the model store, and because most Ollama Docker images run with write access to /usr/lib/ollama, the attacker can place a malicious binary that is executed as root on the next server restart. Any internet- or network-exposed Ollama instance running a version prior to 0.35.0 is affected, making this a critical remote code execution risk for organizations self-hosting LLM inference infrastructure.

Technical Analysis

The vulnerability resides in the model pull workflow exposed by Ollama's HTTP API. When a client requests a model via /api/pull, the server fetches manifest data and downloads individual model layers identified by their digests. The digestToPath function is responsible for translating a layer digest into a filesystem path within the model store. According to the NVD description, this function performs insufficient validation of the digest value, meaning it does not properly constrain or sanitize traversal sequences embedded in the digest string.

Because the digest is not validated against a strict format before being converted into a filesystem path, an attacker can embed a path traversal sequence (e.g., ../) within the digest value. When the server writes the downloaded layer content to the resulting path, the write operation escapes the intended model store directory and lands at an attacker-controlled location on the filesystem. This is a classic CWE-23 (Relative Path Traversal) condition: the application fails to neutralize .. sequences before using externally supplied input to construct a path.

The severity of this issue is amplified by the deployment context. In most Ollama Docker images, the server process runs with write access to /usr/lib/ollama, which is a directory the process loads executable content from. The NVD description states that on the next server restart, a file written to that directory is loaded and executed, resulting in remote code execution as root. This transforms what might otherwise be a limited arbitrary-file-write primitive into a full pre-authentication remote code execution chain.

Two properties make this particularly dangerous. First, the endpoint is unauthenticated — no credentials or API keys are required to trigger the pull flow. Second, the exploit requires no user interaction; the attacker simply sends a crafted request and waits for (or induces) a server restart. The combination of no authentication, no user interaction, and remote code execution as root places this vulnerability at the top of the risk scale for exposed instances.

The fix in version 0.35.0 addresses the digest validation weakness in digestToPath, ensuring that digest-derived paths cannot escape the model store. Note that the CNA title and referenced function name are the only implementation details provided in the source data; no additional code paths, parameter names, or internal structures are asserted here.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-103663, and no Nuclei template or exploit code has been published. The attack chain below is therefore inferred from the vulnerability class (CWE-23 path traversal leading to arbitrary file write and subsequent code execution) and the details explicitly stated in the NVD description. It describes the mechanism at the vulnerability-class level and does not assert specific request payloads beyond the traversal concept.

1) Reconnaissance and target identification. The attacker identifies reachable Ollama instances, typically listening on TCP port 11434. Exposed instances can be found via internet scanning or Shodan queries such as product:"Ollama" or by fingerprinting the Ollama HTTP service. Because the /api/pull endpoint is unauthenticated, no credential-gathering step is required.

2) Triggering the flaw. The attacker initiates a model pull against /api/pull. During the pull, the server processes layer digests and passes each digest to digestToPath to compute an on-disk destination. The attacker supplies a layer digest that contains a path traversal sequence, so that the computed path resolves outside the model store and into a directory the server process can write to — most notably /usr/lib/ollama in the default Docker deployment.

3) Payload placement. The content written to the traversed path is a malicious binary. Because the write escapes the model store, the attacker controls the final filename and location (subject to the permissions of the server process). In the default Docker image, the process has write access to /usr/lib/ollama, so the malicious binary is deposited there.

4) Post-exploitation impact. The NVD description states that on the next server restart, the file placed in /usr/lib/ollama is loaded and executed, yielding remote code execution as root. From that point the attacker has full control of the host or container with root privileges — enabling data theft, lateral movement, persistence, resource abuse (e.g., cryptomining on GPU hosts), or destruction of the environment. The restart requirement means exploitation may depend on a scheduled restart, a crash, or an operator-initiated restart, but it is a low barrier given routine container lifecycle events.

Because there is no public exploit, defenders should treat any unauthorized request to /api/pull carrying traversal-like digest values as a high-confidence intrusion signal.

Impact Assessment

The impact is severe and broad. Successful exploitation yields remote code execution as root, which represents the maximum impact across confidentiality, integrity, and availability. An attacker with root on an Ollama host can read or exfiltrate all data accessible to that host — including model weights, prompt/response logs, API keys, and any credentials mounted into the container — modify or destroy systems, and pivot to other internal services reachable from the host.

The primary affected systems are self-hosted Ollama deployments, particularly containerized deployments using the default Docker images where the process has write access to /usr/lib/ollama. Organizations exposing Ollama on a network interface (especially the internet) without network-layer access controls carry the highest risk. Because the endpoint is unauthenticated, any party that can reach TCP port 11434 can attempt exploitation.

Blast radius considerations: Ollama hosts are frequently provisioned on GPU-equipped servers and may be colocated with other sensitive workloads. Root compromise of such a host can affect adjacent containers and services. The vulnerability is network-exploitable with no privileges and no user interaction required, which concentrates the CVSS impact subscores at High for confidentiality, integrity, and availability (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

No CVSS score or EPSS score has been assigned in the provided data; this report does not fabricate either. The vulnerability is not listed in CISA KEV, and no exploit-in-the-wild or threat-actor campaign has been attributed in the available data.

Detection Guidance

Sigma Rule

title: Potential Ollama Path Traversal Exploitation via /api/pull
id: 8f2c1a94-3b6d-4e7a-9c11-0a5b2d6f7e01
status: experimental
description: Detects HTTP requests to the Ollama /api/pull endpoint containing path traversal sequences in layer digest fields
author: Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: ollama
detection:
    selection_endpoint:
        cs-uri-stem|contains: '/api/pull'
    selection_traversal:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '..%5c'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection_endpoint and selection_traversal
fields:
    - c-ip
    - cs-uri-stem
    - cs-uri-query
    - cs-user-agent
falsepositives:
    - Legitimate model manifests containing '..' in benign metadata (rare)
level: high
tags:
    - attack.t1190
    - cve.2026.103663

YARA Rule

rule CVE_2026_103663_Ollama_PathTraversal
{
    meta:
        description = "Detects path traversal sequences targeting Ollama layer digests in /api/pull requests"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-103663"
        cve = "CVE-2026-103663"

    strings:
        $api = "/api/pull" ascii wide nocase
        $digest = "digest" ascii wide nocase
        $trav1 = "../" ascii wide
        $trav2 = "..\\" ascii wide
        $trav3 = "..%2f" ascii wide nocase
        $trav4 = "%2e%2e%2f" ascii wide nocase
        $ollamadir = "/usr/lib/ollama" ascii wide nocase

    condition:
        $api and ($trav1 or $trav2 or $trav3 or $trav4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103663 Ollama /api/pull Layer Digest Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/pull"; http.request_body; content:"../"; nocase; reference:cve,2026-103663; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-103663; classtype:attempted-admin; sid:2026103663; rev:1;)

alert http any any -> any any (msg:"CVE-2026-103663 Ollama /api/pull Encoded Path Traversal Attempt"; flow:established,to_server; http.uri; content:"/api/pull"; http.request_body; content:"%2e%2e%2f"; nocase; reference:cve,2026-103663; classtype:attempted-admin; sid:2026103664; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [ network where http.request.method == "POST" and url.path == "/api/pull" ]
  [ file where file.path : ("/usr/lib/ollama/*" or "*..%2f*" or "*../*") and event.action in ("creation", "modification") ]

Splunk SPL Query

index=ollama OR index=web OR index=proxy sourcetype=access_combined OR sourcetype=ollama:server
| search uri_path="/api/pull" (uri_query="*../*" OR uri_query="*..%2f*" OR uri_query="*%2e%2e%2f*" OR request_body="*../*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, user_agent
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="ollama,web,attack,">
  <rule id="2026030" level="12">
    <if_sid>31100</if_sid>
    <match>/api/pull</match>
    <match>\.\./</match>
    <description>CVE-2026-103663: Potential Ollama /api/pull path traversal attempt (layer digest)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_103663,</group>
  </rule>

  <rule id="2026031" level="12">
    <if_sid>31100</if_sid>
    <match>/api/pull</match>
    <match>%2e%2e%2f</match>
    <description>CVE-2026-103663: Ollama /api/pull encoded path traversal attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_103663,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations.

• Do not expose the Ollama API (default TCP port 11434) to untrusted networks or the internet. Bind it to localhost or a restricted management interface and place it behind authentication and network access controls.
• Where network exposure is unavoidable, restrict access with firewall rules, security groups, or a reverse proxy that enforces authentication and blocks requests containing path traversal sequences (../, ..\, and their URL-encoded forms) targeting /api/pull.
• Run Ollama with a non-root user and with a read-only root filesystem where feasible, and remove unnecessary write permissions to /usr/lib/ollama. Removing write access to that directory breaks the code-execution prerequisite described in the NVD advisory.
• Monitor and alert on unexpected files appearing in /usr/lib/ollama and on restarts of the Ollama service.

2) Patch/upgrade steps.

• Upgrade Ollama to version 0.35.0 or later, which the NVD description states fixes the issue. Until the upgrade is verified in your environment, apply the interim hardening above. Note: the tracked patch evidence is currently 0/4; verify release artifacts directly from the vendor before relying solely on a stated version.
• Rebuild container images from an updated base rather than patching running containers in place.

3) Long-term hardening.

• Treat self-hosted inference runtimes as internet-facing attack surface and apply the same segmentation, authentication, and least-privilege controls used for other exposed services.
• Enforce least privilege for all model-serving processes; avoid root execution and writable application directories.
• Deploy file-integrity monitoring across model-store and executable directories, and maintain egress filtering to limit post-exploitation movement.
• Establish a vulnerability management process that tracks upstream advisories for AI/LLM infrastructure and validates that fixes are applied.

References

• NVD — CVE-2026-103663: https://nvd.nist.gov/vuln/detail/CVE-2026-103663
• CWE-23: Relative Path Traversal — https://cwe.mitre.org/data/definitions/23.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• Ollama project (upstream release/advisory source for version 0.35.0 fix) — https://github.com/ollama/ollama
• CISA Known Exploited Vulnerabilities Catalog (checked; CVE-2026-103663 is NOT listed as of this report) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or threat-actor campaign has been identified for CVE-2026-103663 in the available data. The vulnerability is not present in CISA KEV, and no EPSS score has been published by FIRST.org.