ACVE-2026-0315

In the wild

demonstrated · research

Description

What

The Ollama advisory describes a GGUF parser issue before 0.17.1 and the related model-pull surface available to a network caller. The research also records an unconfirmed issue alleging model injection from an attacker registry. The CVE claim and the unconfirmed incident claim stay separate; this record does not promote the latter to proof of exploitation.

Which configuration is exposed

The exposed setup is an Ollama service below 0.17.1 whose OLLAMA_HOST setting makes it reachable beyond loopback. A remote caller can then reach the service boundary that accepts model operations. The vulnerability is version-dependent, while the exposure condition is independently important for limiting who can send those requests.

How ACVE detects it

ACVE requires the Ollama harness id, the vulnerable version range, and the discovered OLLAMA_HOST.set feature. It does not probe a listener or infer bind addresses from the network. Missing version or feature data produces an unknown condition and therefore a possible result.

Fix

Upgrade Ollama to 0.17.1 or later, bind OLLAMA_HOST to loopback, and put authentication and network policy in front of any intentional remote service. Review model pull sources and delete untrusted GGUF files. Treat the attacker-registry claim as a separate investigation until a primary incident source confirms it.

Grounding needed

The GitLab advisory should confirm the CVE range and fixed version; the issue page should remain labelled unconfirmed. The lock currently represents the host exposure feature rather than an active network probe.

This record is limited to the condition named in the public source: Ollama before 0.17.1 exposes a GGUF parser and pull boundary. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

and
  harness.id eq "ollama"
  harness.version semverRange "<0.17.1"
  features["OLLAMA_HOST.set"] eq true

Fix

Upgrade Ollama to 0.17.1 or later and bind the service privately.

• Upgrade harness:ollama to 0.17.1. Use the fixed release.
• Reconfigure OLLAMA_HOST to 127.0.0.1. Do not expose model pull and parser endpoints.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

ADVISORY

• https://advisories.gitlab.com/golang/github.com/ollama/ollama/CVE-2026-7482/

DISCUSSION

• https://github.com/ollama/ollama/issues/16236