{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0315",
  "aliases": [
    "CVE-2026-7482"
  ],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Ollama before 0.17.1 exposes a GGUF parser and pull boundary",
  "details": "## What\n\nThe Ollama advisory describes a GGUF parser issue before 0.17.1 and the related model-pull surface available to a network caller. The research also records an unconfirmed issue alleging model injection from an attacker registry. The CVE claim and the unconfirmed incident claim stay separate; this record does not promote the latter to proof of exploitation.\n\n## Which configuration is exposed\n\nThe exposed setup is an Ollama service below 0.17.1 whose OLLAMA_HOST setting makes it reachable beyond loopback. A remote caller can then reach the service boundary that accepts model operations. The vulnerability is version-dependent, while the exposure condition is independently important for limiting who can send those requests.\n\n## How ACVE detects it\n\nACVE requires the Ollama harness id, the vulnerable version range, and the discovered OLLAMA_HOST.set feature. It does not probe a listener or infer bind addresses from the network. Missing version or feature data produces an unknown condition and therefore a possible result.\n\n## Fix\n\nUpgrade Ollama to 0.17.1 or later, bind OLLAMA_HOST to loopback, and put authentication and network policy in front of any intentional remote service. Review model pull sources and delete untrusted GGUF files. Treat the attacker-registry claim as a separate investigation until a primary incident source confirms it.\n\n## Grounding needed\n\nThe GitLab advisory should confirm the CVE range and fixed version; the issue page should remain labelled unconfirmed. The lock currently represents the host exposure feature rather than an active network probe.\n\nThis record is limited to the condition named in the public source: Ollama before 0.17.1 exposes a GGUF parser and pull boundary. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "ollama"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.17.1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.gitlab.com/golang/github.com/ollama/ollama/CVE-2026-7482/"
    },
    {
      "type": "DISCUSSION",
      "url": "https://github.com/ollama/ollama/issues/16236"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "denial-of-service",
        "exposed-surface"
      ],
      "cwe": [
        "CWE-306"
      ],
      "exploitation": {
        "status": "demonstrated",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://advisories.gitlab.com/golang/github.com/ollama/ollama/CVE-2026-7482/",
            "type": "research"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "cve-aliased",
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "ollama"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<0.17.1"
          },
          {
            "field": "features[\"OLLAMA_HOST.set\"]",
            "op": "eq",
            "value": true
          }
        ]
      },
      "fix": {
        "summary": "Upgrade Ollama to 0.17.1 or later and bind the service privately.",
        "actions": [
          {
            "type": "upgrade",
            "target": "harness:ollama",
            "to": "0.17.1",
            "why": "Use the fixed release."
          },
          {
            "type": "reconfigure",
            "target": "OLLAMA_HOST",
            "to": "127.0.0.1",
            "why": "Do not expose model pull and parser endpoints."
          }
        ]
      }
    }
  }
}