CVE-2026-108836: Ollama SSRF — HIGH

CISO Take

Ollama versions up to 0.34.1 contain a server-side request forgery flaw in the model name validation logic (IsValid in types/model/name.go) of the Pull API, which lets a remote, unauthenticated attacker make the Ollama server send requests to destinations of their choosing. Ollama is widely deployed as a local and self-hosted LLM inference server, and instances exposed to networks or the internet without an authenticating reverse proxy are the realistic targets; the CVSS 7.3 score reflects network reach, low complexity and no privileges required, with limited confidentiality, integrity and availability impact. There is no CISA KEV listing, no EPSS data, no Nuclei template and no confirmed public exploit code, although the report states the exploit details have been disclosed publicly, so weaponization risk is moderate and should be treated as rising. The main concern is pivoting to cloud metadata services (such as IMDS) or internal-only services reachable from the inference host. Upgrade to Ollama 0.34.2 (commit dfabde4) and make sure no Ollama instance is directly reachable from untrusted networks.

Sources:NVDATLASvuldb.comgithub.com/ollama/ollama

What is the risk?

Medium-high. The flaw is network-exploitable, needs no authentication or user interaction, and has low attack complexity (CVSS 7.3). Impact is bounded to limited confidentiality, integrity and availability effects, so it is not a direct RCE. Exposure is the key variable: Ollama's API has no built-in authentication, so any instance bound to 0.0.0.0 or published through a proxy is reachable. No KEV listing, no Nuclei template and no EPSS data are available, and a public exploit is not confirmed even though the disclosure claims the exploit is public. Note that the references include a third-party proof-of-concept repository and the VulDB entry, so the technique is documented.

How does the attack unfold?

Discovery

Attacker locates an Ollama API endpoint reachable over the network, typically on port 11434, with no authentication.

AML.T0006

Exploitation

Attacker sends a crafted model name to the Pull API that bypasses IsValid validation and triggers a server-side request to a chosen destination.

AML.T0049

Internal Access

The server fetches internal resources such as cloud metadata or internal services, exposing data or credentials.

Impact

Attacker uses leaked information to pivot within the network or cloud account, or to tamper with model sources.

Discovery

Attacker locates an Ollama API endpoint reachable over the network, typically on port 11434, with no authentication.

AML.T0006

Exploitation

Attacker sends a crafted model name to the Pull API that bypasses IsValid validation and triggers a server-side request to a chosen destination.

AML.T0049

Internal Access

The server fetches internal resources such as cloud metadata or internal services, exposing data or credentials.

Impact

Attacker uses leaked information to pivot within the network or cloud account, or to tamper with model sources.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ollama	pip	—	No patch
184.7K1.8K dependentsPushed 7d ago19% patched~29d to patchFull package profile →

Do you use Ollama? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Upgrade Ollama to 0.34.2 or later (fix commit dfabde4539e42ba1e1eab50a3a50b88aea7958a0, PR 18512). 2) Do not expose the Ollama API (default port 11434) to untrusted networks; bind to 127.0.0.1 or place it behind an authenticating reverse proxy or VPN. 3) Restrict egress traffic from inference hosts with allowlists so only approved model registries are reachable, and block access to link-local metadata addresses (169.254.169.254); enforce IMDSv2 with hop limit 1 on cloud instances. 4) Detect by reviewing Ollama logs and proxy logs for unexpected POST requests to /api/pull with unusual or URL-like model names, and by monitoring outbound connections from inference hosts to internal ranges or unfamiliar domains. 5) Inventory all Ollama instances, including shadow-IT and developer deployments, and verify versions.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassInferenceAPIAML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to risks and unknown risks are in place

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-108836?

Ollama versions up to 0.34.1 contain a server-side request forgery flaw in the model name validation logic (IsValid in types/model/name.go) of the Pull API, which lets a remote, unauthenticated attacker make the Ollama server send requests to destinations of their choosing. Ollama is widely deployed as a local and self-hosted LLM inference server, and instances exposed to networks or the internet without an authenticating reverse proxy are the realistic targets; the CVSS 7.3 score reflects network reach, low complexity and no privileges required, with limited confidentiality, integrity and availability impact. There is no CISA KEV listing, no EPSS data, no Nuclei template and no confirmed public exploit code, although the report states the exploit details have been disclosed publicly, so weaponization risk is moderate and should be treated as rising. The main concern is pivoting to cloud metadata services (such as IMDS) or internal-only services reachable from the inference host. Upgrade to Ollama 0.34.2 (commit dfabde4) and make sure no Ollama instance is directly reachable from untrusted networks.

Is CVE-2026-108836 actively exploited?

No confirmed active exploitation of CVE-2026-108836 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108836?

1) Upgrade Ollama to 0.34.2 or later (fix commit dfabde4539e42ba1e1eab50a3a50b88aea7958a0, PR 18512). 2) Do not expose the Ollama API (default port 11434) to untrusted networks; bind to 127.0.0.1 or place it behind an authenticating reverse proxy or VPN. 3) Restrict egress traffic from inference hosts with allowlists so only approved model registries are reachable, and block access to link-local metadata addresses (169.254.169.254); enforce IMDSv2 with hop limit 1 on cloud instances. 4) Detect by reviewing Ollama logs and proxy logs for unexpected POST requests to /api/pull with unusual or URL-like model names, and by monitoring outbound connections from inference hosts to internal ranges or unfamiliar domains. 5) Inventory all Ollama instances, including shadow-IT and developer deployments, and verify versions.

What systems are affected by CVE-2026-108836?

This vulnerability affects the following AI/ML architecture patterns: model serving, local LLM inference, self-hosted LLM gateways, agent frameworks backed by Ollama, developer AI workstations.

What is the CVSS score for CVE-2026-108836?

CVE-2026-108836 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

model servinglocal LLM inferenceself-hosted LLM gatewaysagent frameworks backed by Ollamadeveloper AI workstations

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.

Exploitation Scenario

An attacker scans for exposed Ollama endpoints on port 11434 and finds an inference server in a cloud environment. They send a crafted request to the Pull API with a manipulated model name that bypasses the IsValid check, causing the server to issue a request to an internal address such as the cloud metadata service or an internal admin interface. Responses or error messages leak information about internal services or temporary credentials, which the attacker then uses to move laterally into the cloud account or to access other AI infrastructure such as vector databases and model stores.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.