Probllama: Ollama Path Traversal to RCE (CVE-2024-37032)

What to do

1. Check your version with `ollama --version` (or the image tag) and upgrade to a current release
2. Make sure the API listens only on 127.0.0.1 unless you deliberately need remote access; check OLLAMA_HOST and Docker -p mappings
3. Put any remote Ollama behind a reverse proxy or gateway that enforces authentication
4. Block inbound TCP 11434 at the firewall or security group
5. Avoid running the container as root where your deployment allows it

How to check if you are affected or compromised

• From outside your network, test whether http://<host>:11434/api/tags answers; if it does, you are exposed
• Review Ollama logs for /api/pull or /api/push calls naming registries you do not use
• On older Docker hosts, inspect /etc/ld.so.preload and the models directory for unexpected files

What happened#

On June 24, 2024 Wiz published "Probllama," a remote code execution chain in Ollama, the popular tool for running open-weight LLMs locally. Ollama can pull models from private registries through /api/pull. A malicious registry could serve a manifest whose layer digest field contained path traversal sequences, and Ollama used that value to build file paths without validating it. That gave an attacker arbitrary file write. A related path gave arbitrary file read, by pushing a chosen file to an attacker's registry with /api/push.

On Docker, Wiz turned the file write into code execution. It planted a malicious shared library and overwrote /etc/ld.so.preload, so that the next process Ollama spawned (triggered via /api/chat) loaded the payload. NVD's record describes the root cause as Ollama before 0.1.34 not validating that the digest is "sha256 with 64 hex digits." The only score listed there is CVSS 3.1 8.8, from CISA's ADP enrichment rather than a primary NVD analysis.

Who is affected#

Versions before 0.1.34 are vulnerable. Wiz reported the bug on May 5, 2024, a fix was committed within hours, and Wiz dates the patched release to May 8. The v0.1.34 GitHub release shows a May 7 timestamp (UTC) and does not mention the security fix in its notes. The CVE record was published on May 31, ahead of Wiz's write-up.

How bad it was depended on deployment. Ollama has no built-in authentication. The default Linux install binds to localhost, which keeps remote attackers out. The Docker image, however, listens on 0.0.0.0 and runs as root, which is what made the remote, root-level chain possible. Wiz found more than 1,000 exposed Ollama instances at the time, some hosting private models.

Do you really need to act?#

For the CVE itself, probably not: if you have updated Ollama at any point since May 2024 you are past the fix. As of October 21, 2026 the CVE is not in CISA's KEV catalog, and we found no confirmed in-the-wild exploitation. Wiz published enough detail to reproduce the chain, so treat any unpatched, reachable instance as trivially exploitable.

The exposure problem is the real story, and it has grown. In January 2026 SentinelOne and Censys reported 175,000 publicly reachable Ollama hosts across 130 countries, observed over 293 days. Roughly half of them were configured with tool-calling capabilities that let them run code or reach external APIs. Even a fully patched Ollama with its API open to the internet hands strangers your GPU, your models and whatever tools you have wired in. If your Ollama is reachable from the internet, fix that this week.

What to do now#

1. Check the version (ollama --version, or your image tag) and upgrade.
2. Bind to localhost: check OLLAMA_HOST and avoid -p 11434:11434 on internet-facing hosts. Use -p 127.0.0.1:11434:11434 instead.
3. If remote access is required, front Ollama with a reverse proxy that enforces authentication, as Wiz recommends.
4. Block inbound TCP 11434 at your firewall or cloud security group.
5. Run the container as a non-root user where your setup allows it.

How to tell if you were hit#

From a machine outside your network, request http://<your-ip>:11434/api/tags. A model list in response means you are exposed. On hosts that ran a pre-0.1.34 build while exposed, review logs for /api/pull or /api/push requests naming unfamiliar registries, and inspect /etc/ld.so.preload and the models directory for files you did not put there. If you find any, rebuild the host.

Timeline#

• May 5, 2024 — Wiz reports the issue. Ollama acknowledges it and commits a fix within hours.
• May 7, 2024 — v0.1.34 published on GitHub (Wiz dates the patched release May 8).
• May 31, 2024 — CVE-2024-37032 published.
• Jun 24, 2024 — Wiz publishes Probllama.
• Jan 30, 2026 — SentinelOne/Censys exposure research reported: 175,000 public Ollama hosts.

Vulnerability records

• CVE-2024-37032 · Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Wiz — Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) wiz.io
2. NVD — CVE-2024-37032 nvd.nist.gov
3. Ollama (GitHub) — Release v0.1.34 github.com

Coverage and analysis

1. SecurityWeek — 175,000 Exposed Ollama Hosts Could Enable LLM Abuse securityweek.com