CVE-2026-108836: Ollama Pull API name.go IsValid server-side request forgery
A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ollamato a version that resolves this vulnerability.Fixed in 0.34.2Patch dfabde4539e42ba1e1eab50a3a50b88aea7958a0
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Ollama versions up to 0.34.1 are affected. Prioritize instances where the Pull API is remotely reachable, since the attack can be initiated remotely without stated prerequisites.
What does an attacker need to exploit this issue?
The available information states that exploitation can be performed remotely and does not identify required privileges or user interaction. Public exploit disclosure means attempts may be practical.
What is the recommended remediation?
Upgrade Ollama to version 0.34.2. The referenced fix is patch dfabde4539e42ba1e1eab50a3a50b88aea7958a0.