--- title: "CVE-2026-108836: Ollama - Server Side Request Forgery" description: "Ollama <= 0.34.1 contains a server-side request forgery caused by manipulation in the IsValid function of Pull API, letting remote attackers initiate SSRF, exploit requires network access." url: https://panop.io/threat-heartbeat/CVE-2026-108836/ --- # CVE-2026-108836 Ollama - Server Side Request Forgery Ollama <= 0.34.1 contains a server-side request forgery caused by manipulation in the IsValid function of Pull API, letting remote attackers initiate SSRF, exploit requires network access. CVSS base score 7.3 /10 High CISA KEV Not listed Public exploit None known Authentication Not required EPSS 0.47% chance of exploitation in 30 days [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-108836) ## Details Type Server Side Request Forgery Impact Server Side Request Forgery CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Published 12 October 2026 Updated 15 October 2026 Weakness [CWE-918](https://cwe.mitre.org/data/definitions/918.html) ## Vendor fix Upgrade to version 0.34.2. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-108836](https://nvd.nist.gov/vuln/detail/CVE-2026-108836) - [https://vuldb.com/cve/CVE-2026-108836](https://vuldb.com/cve/CVE-2026-108836) - [https://vuldb.com/vuln/416610](https://vuldb.com/vuln/416610) - [https://vuldb.com/vuln/416610/cti](https://vuldb.com/vuln/416610/cti) - [https://github.com/aLtEr6/test.git](https://github.com/aLtEr6/test.git) - [https://github.com/aLtEr6/test/blob/main/test.pdf](https://github.com/aLtEr6/test/blob/main/test.pdf) - [https://vuldb.com/submit/972855](https://vuldb.com/submit/972855) - [https://github.com/ollama/ollama/](https://github.com/ollama/ollama/) - [https://github.com/ollama/ollama/commit/dfabde4539e42ba1e1eab50a3a50b88aea7958a0](https://github.com/ollama/ollama/commit/dfabde4539e42ba1e1eab50a3a50b88aea7958a0) - [https://github.com/ollama/ollama/pull/18512](https://github.com/ollama/ollama/pull/18512) - [https://github.com/ollama/ollama/releases/tag/v0.34.2](https://github.com/ollama/ollama/releases/tag/v0.34.2) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)