CVE-2026-108836

Executive Summary

CVE-2026-108836 is a server-side request forgery (SSRF) vulnerability in Ollama up to version 0.34.1, residing in the IsValid function of types/model/name.go within the Pull API component. According to the NVD description, the flaw allows an attacker to influence server-side request handling, is exploitable remotely without authentication, and has been publicly disclosed. The impact per the assigned CVSS v3.1 vector is moderate across confidentiality, integrity, and availability (Low/Low/Low, base 7.3), affecting any internet-exposed Ollama instance that has not been upgraded to 0.34.2.

Technical Analysis

Ollama is a widely deployed local large-language-model (LLM) runtime that exposes an HTTP API (commonly on port 11434) used by clients to pull, run, and manage models. The vulnerability is classified as CWE-918: Server-Side Request Forgery. Per the NVD description, the affected element is the IsValid function in the file types/model/name.go, within the Pull API component.

The IsValid function is named in the description as the location of the flaw; this indicates that a model-name (or equivalent identifier) validation routine fails to properly constrain the input that is subsequently used to construct a server-side request. In an SSRF condition, the attacker supplies crafted input to an endpoint that causes the server to initiate an outbound request to a destination of the attacker's choosing — for example an internal service, a metadata endpoint, or an attacker-controlled host. The description states that "the manipulation leads to server-side request forgery" and that the attack can be initiated remotely, confirming the exposed Pull API is the attack surface.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates: network-reachable, low attack complexity, no privileges required, no user interaction, scope unchanged, and limited (Low) impact to confidentiality, integrity, and availability. The absence of privilege requirements and user interaction, combined with public disclosure, raises the practical urgency for any externally reachable deployment. The commit dfabde4539e42ba1e1eab50a3a50b88aea7958a0 is cited as the fix, and upgrading to 0.34.2 is stated to be sufficient.

Specific request-construction code paths, accepted parameters beyond the model name, and redirect behavior are not enumerated in the source description, and are therefore intentionally not asserted here. The vulnerability class — SSRF via insufficient identifier validation — is the authoritative characterization.

Exploitation Scenarios

No public PoC code is tracked in the available intelligence feeds; the attack chain below is inferred at the vulnerability-class level strictly from the NVD description.

1. Reconnaissance / target identification. An attacker enumerates internet-exposed Ollama services. Default deployments listen on TCP/11434, and banner/HTML indicators such as "Ollama is running" are commonly observable. Shodan-style queries (product:"Ollama", port:11434) can identify candidate hosts at scale.

2. Trigger. The attacker sends a request to the vulnerable Pull API component, supplying a crafted input that passes through the IsValid validation routine in types/model/name.go but is subsequently used to build a server-side request. Because IsValid fails to reject the crafted value, the server proceeds to issue an outbound request derived from attacker-controlled input.

3. Execution (vulnerability-class level). The server, acting on the attacker's behalf, performs an HTTP request to a destination influenced by the attacker. Typical SSRF objectives include reaching internal-only services, loopback interfaces, private-range hosts, or cloud instance metadata endpoints that are otherwise unreachable from the internet. No specific payload string, URL scheme, or parameter name is asserted because none is given in the source description.

4. Post-exploitation impact. Consistent with the Low/Low/Low subscores, an attacker can use the server's network position to probe internal resources or retrieve information (confidentiality), potentially write/modify state on reachable internal services (integrity), and induce resource consumption or denial conditions against internal targets (availability). Scope is unchanged, so the direct impact is bounded to systems the Ollama host can reach, but an exposed host can serve as a pivot point into a flat internal network.

Given the public disclosure, defenders should assume exploitation attempts will follow rapidly and prioritize upgrade to 0.34.2.

Impact Assessment

• Affected systems: Any Ollama deployment at version 0.34.1 or earlier, particularly internet-exposed instances or those reachable from untrusted networks. Developer workstations, CI runners, and internal inference hosts running Ollama are in scope if an attacker can reach the API.
• CVSS subscores: Confidentiality Low, Integrity Low, Availability Low; base 7.3 (High severity band). The High base score stems from the network attack vector, low complexity, and no required privileges or user interaction, despite the Low impact subscores.
• Blast radius: Scope is Unchanged (S:U), so the direct effect is bounded to the Ollama host and the network services it can reach. However, SSRF frequently enables reconnaissance and lateral movement into otherwise segmented internal networks, cloud metadata services, and administrative interfaces — leveraging the trust position of the Ollama host.
• Business impact: Potential exposure of sensitive internal endpoints and metadata, use of the model server as a pivot, and, in shared/multi-tenant environments, cross-boundary access. Because Ollama is often deployed informally by engineering teams outside standard change control, shadow instances may remain unpatched.

Detection Guidance

Detection focuses on anomalous outbound requests originating from Ollama hosts and on inbound requests to the Pull API carrying malformed or unusual model-name identifiers. Because no PoC string is available, rules below target behavior and identifiers named in the source description rather than a fixed payload.

Sigma Rule

title: Ollama Pull API SSRF Exploitation Attempt (CVE-2026-108836)
id: 7c9a1f2e-4b3d-4e8a-9f21-0a6b7c8d9e10
status: experimental
description: Detects requests to the Ollama Pull API with model-name identifiers that include URL/scheme artifacts, indicating SSRF attempts against CVE-2026-108836.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108836
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/api/pull'
  selection_payload:
    cs-uri-query|contains:
      - 'http://'
      - 'https://'
      - 'file://'
      - 'gopher://'
      - '169.254.169.254'
      - 'metadata.google.internal'
      - '../'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate proxy or registry configurations where full URLs are expected in model references
level: high
tags:
  - attack.t1190
  - cve.2026-108836
  - cwe.918

YARA Rule

rule CVE_2026_108836_Ollama_SSRF_Payload
{
    meta:
        description = "Detects SSRF-oriented payloads targeting the Ollama Pull API IsValid validation (CVE-2026-108836)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108836"
        date = "2026-01-01"
        severity = "high"
    strings:
        $pull = "/api/pull" ascii nocase
        $m1 = "http://" ascii nocase
        $m2 = "https://" ascii nocase
        $m3 = "file://" ascii nocase
        $m4 = "gopher://" ascii nocase
        $m5 = "169.254.169.254" ascii
        $m6 = "metadata.google.internal" ascii nocase
        $n1 = "name=" ascii nocase
    condition:
        $pull and $n1 and any of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108836 Ollama Pull API SSRF Attempt"; flow:to_server,established; http.uri; content:"/api/pull"; http.uri; content:"name="; pcre:"/name=[^&]*(https?|file|gopher):\/\//i"; pcre:"/169\.254\.169\.254|metadata\.google\.internal/i"; reference:cve,2026-108836; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108836; classtype:attempted-recon; sid:2026108836; rev:1;)

Elastic Detection

sequence by host.id with maxspan=30s
  [ network where network.direction == "inbound"
      and http.request.method == "POST"
      and url.path like "/api/pull" ]
  [ network where network.direction == "outbound"
      and destination.ip in ("169.254.169.254", "127.0.0.1", "::1")
      and process.name != null ]

Splunk SPL Query

index=web OR index=proxy
| eval uri = lower(coalesce(uri, url, cs_uri_stem))
| eval query = lower(coalesce(uri_query, cs_uri_query, url))
| where like(uri, "%/api/pull%") AND (like(query, "%http://%") OR like(query, "%https://%") OR like(query, "%file://%") OR like(query, "%169.254.169.254%") OR like(query, "%metadata.google%"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, uri, query
| sort - count
| table src_ip, dest_ip, uri, query, count, first_seen, last_seen

Wazuh OSSEC Rule

<group name="web,ollama,ssrf,">
  <rule id="2026108" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/api/pull</field>
    <regex type="pcre2">(?i)(https?|file|gopher):/|169\.254\.169\.254|metadata\.google\.internal</regex>
    <description>CVE-2026-108836: Possible Ollama Pull API SSRF attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_108836,ssrf_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Do not expose the Ollama API (default port 11434) to untrusted networks. Restrict access via firewall/security-group rules and bind to loopback or a private interface where possible.
   • Place the API behind an authenticating reverse proxy and enforce strict allow-lists on outbound egress from Ollama hosts (block access to link-local/metadata IP 169.254.169.254 and internal-only ranges).
   • Apply network segmentation so an SSRF pivot cannot reach sensitive internal services; enable cloud metadata protection (IMDSv2) where applicable.
   • Monitor for anomalous outbound requests originating from Ollama hosts.

2. Patch / upgrade steps

   • Upgrade to Ollama 0.34.2, which the NVD description states is sufficient to fix the issue. The fix is associated with commit dfabde4539e42ba1e1eab50a3a50b88aea7958a0.
   • Rebuild/redeploy affected containers or hosts, verify the running version, and confirm no stale 0.34.1 or earlier instances remain (including shadow/developer deployments).

3. Long-term hardening

   • Maintain an inventory of AI/LLM runtimes, including unofficial deployments, and include them in vulnerability management.
   • Enforce egress filtering and least-privilege network policy for all model-serving hosts by default.
   • Track the Ollama project release channel and vendor advisories; because patch confidence here is 0/4, verify the fixed version through an authoritative vendor advisory before relying on a single reference.

References

• NVD — CVE-2026-108836: https://nvd.nist.gov/vuln/detail/CVE-2026-108836
• CWE-918: Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Ollama project releases and security advisories: https://github.com/ollama/ollama/releases
• FIRST EPSS (not yet scored for this CVE at time of writing): https://www.first.org/epss/

No threat-actor campaign or confirmed exploit-in-the-wild evidence is available in the provided intelligence feeds. CISA KEV status: not listed. This CVE is publicly disclosed and should be treated as high priority for internet-exposed Ollama deployments pending upgrade to 0.34.2.