CVE-2026-108836

Ollama model pulls can reach unintended network destinations

Ollama · Ollama Pull API

First documented disclosure · Review checkpoint

Summary

The CVE authority reports server-side request forgery in model-pull name validation.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Insufficient destination validation can permit server-side requests outside intended registry boundaries.

Conditions required

Remote access to an affected Pull API; practical reach depends on server network privileges.

Potential impact

Potential access to or interaction with network services reachable by the server.

Affected versions and configurations

CNA description: through 0.34.1; structured affected list names 0.34.0 and 0.34.1.

Fix and mitigation status

0.34.2, per the CNA.

Practical next steps

Upgrade, restrict model-pull access and control inference-server egress.

Operating lesson

Validate resolved addresses and every redirect rather than trusting the first hostname.

Evidence and limits

The CNA links the September 17 public redirect-hardening PR; CVE publication followed October 12. The linked 0.34.2 release has inconsistent creation/publication timestamps, so it is not used to backdate disclosure. Public exploit availability is not evidence of malicious use. The historical 0.34.2 fix is affected by the separate CVE-2026-103663; use current vendor guidance rather than treating an older issue-specific fix as a safe overall baseline.

Sources