CVE-2026-108836
Ollama Pull API name.go IsValid server-side request forgery
n/a Ollama
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.
Text from CVE List
Affected versions 3
- Ollamaaffected: 0.34.0CVE List
- Ollamaaffected: 0.34.1CVE List
- Ollamaunaffected: 0.34.2CVE List
References 10
- github.com/ollama/ollama/pull/18512Fixvia CVE List
- github.com/ollama/ollama/commit/dfabde4539e42ba1e1eab50a3a50b88aea7958a0Fixvia CVE List
- github.com/ollama/ollama/releases/tag/v0.34.2Fixvia CVE List
- vuldb.com/cve/CVE-2026-108836Advisoryvia CVE List
- vuldb.com/submit/972855Advisoryvia CVE List
- github.com/aLtEr6/test/blob/main/test.pdfExploitvia CVE List
- vuldb.com/vuln/416610Referencevia CVE List
- vuldb.com/vuln/416610/ctiReferencevia CVE List
- github.com/aLtEr6/test.gitReferencevia CVE List
- github.com/ollama/ollama/Referencevia CVE List