---
title: "Probllama: Ollama Path Traversal to RCE (CVE-2024-37032)"
url: https://erroneo.us/security/briefs/ollama-probllama-path-traversal-rce-cve-2024-37032/
description: "Ollama before 0.1.34 let a malicious registry write arbitrary files, leading to RCE on exposed Docker installs. Upgrade and never expose port 11434."
type: security-brief
section: "Security Digest"
date_published: 2024-06-24
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-37032"]
severity: "high"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Probllama: Ollama Path Traversal to RCE (CVE-2024-37032)

**Verdict: Check exposure.** The bug was fixed in May 2024, so anything current is patched; the lasting risk is Ollama servers left reachable from the internet with no authentication, which is still very common.

- **Who must act:** Anyone running Ollama older than 0.1.34, and anyone whose Ollama API (port 11434) is reachable from outside the host, especially Docker deployments, which listen on 0.0.0.0 and run as root by default.
- **Who can relax:** Users of a current Ollama build on a laptop or the default Linux install bound to 127.0.0.1 were never remotely reachable and are patched.
- **Affected:** Ollama before 0.1.34
- **Fixed:** Ollama 0.1.34 and later
- **CVEs:** CVE-2024-37032
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Check your version with `ollama --version` (or the image tag) and upgrade to a current release
2. Make sure the API listens only on 127.0.0.1 unless you deliberately need remote access; check OLLAMA_HOST and Docker -p mappings
3. Put any remote Ollama behind a reverse proxy or gateway that enforces authentication
4. Block inbound TCP 11434 at the firewall or security group
5. Avoid running the container as root where your deployment allows it

### How to check if you are affected

- From outside your network, test whether http://<host>:11434/api/tags answers; if it does, you are exposed
- Review Ollama logs for /api/pull or /api/push calls naming registries you do not use
- On older Docker hosts, inspect /etc/ld.so.preload and the models directory for unexpected files

## What happened

On June 24, 2024 Wiz published "[Probllama](https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032)," a remote code execution chain in Ollama, the popular tool for running open-weight LLMs locally. Ollama can pull models from private registries through `/api/pull`. A malicious registry could serve a manifest whose layer `digest` field contained path traversal sequences, and Ollama used that value to build file paths without validating it. That gave an attacker arbitrary file write. A related path gave arbitrary file read, by pushing a chosen file to an attacker's registry with `/api/push`.

On Docker, Wiz turned the file write into code execution. It planted a malicious shared library and overwrote `/etc/ld.so.preload`, so that the next process Ollama spawned (triggered via `/api/chat`) loaded the payload. [NVD's record](https://nvd.nist.gov/vuln/detail/CVE-2024-37032) describes the root cause as Ollama before 0.1.34 not validating that the digest is "sha256 with 64 hex digits." The only score listed there is CVSS 3.1 8.8, from CISA's ADP enrichment rather than a primary NVD analysis.

## Who is affected

Versions before 0.1.34 are vulnerable. Wiz reported the bug on May 5, 2024, a fix was committed within hours, and Wiz dates the patched release to May 8. The [v0.1.34 GitHub release](https://github.com/ollama/ollama/releases/tag/v0.1.34) shows a May 7 timestamp (UTC) and does not mention the security fix in its notes. The CVE record was published on May 31, ahead of Wiz's write-up.

How bad it was depended on deployment. Ollama has no built-in authentication. The default Linux install binds to localhost, which keeps remote attackers out. The Docker image, however, listens on 0.0.0.0 and runs as root, which is what made the remote, root-level chain possible. Wiz found more than 1,000 exposed Ollama instances at the time, some hosting private models.

## Do you really need to act?

For the CVE itself, probably not: if you have updated Ollama at any point since May 2024 you are past the fix. As of October 21, 2026 the CVE is not in CISA's KEV catalog, and we found no confirmed in-the-wild exploitation. Wiz published enough detail to reproduce the chain, so treat any unpatched, reachable instance as trivially exploitable.

The exposure problem is the real story, and it has grown. In January 2026 [SentinelOne and Censys reported](https://www.securityweek.com/175000-exposed-ollama-hosts-could-enable-llm-abuse/) 175,000 publicly reachable Ollama hosts across 130 countries, observed over 293 days. Roughly half of them were configured with tool-calling capabilities that let them run code or reach external APIs. Even a fully patched Ollama with its API open to the internet hands strangers your GPU, your models and whatever tools you have wired in. If your Ollama is reachable from the internet, fix that this week.

## What to do now

1. Check the version (`ollama --version`, or your image tag) and upgrade.
2. Bind to localhost: check `OLLAMA_HOST` and avoid `-p 11434:11434` on internet-facing hosts. Use `-p 127.0.0.1:11434:11434` instead.
3. If remote access is required, front Ollama with a reverse proxy that enforces authentication, as Wiz recommends.
4. Block inbound TCP 11434 at your firewall or cloud security group.
5. Run the container as a non-root user where your setup allows it.

## How to tell if you were hit

From a machine outside your network, request `http://<your-ip>:11434/api/tags`. A model list in response means you are exposed. On hosts that ran a pre-0.1.34 build while exposed, review logs for `/api/pull` or `/api/push` requests naming unfamiliar registries, and inspect `/etc/ld.so.preload` and the models directory for files you did not put there. If you find any, rebuild the host.

## Timeline

- May 5, 2024 — Wiz reports the issue. Ollama acknowledges it and commits a fix within hours.
- May 7, 2024 — v0.1.34 published on GitHub (Wiz dates the patched release May 8).
- May 31, 2024 — CVE-2024-37032 published.
- Jun 24, 2024 — Wiz publishes Probllama.
- Jan 30, 2026 — SentinelOne/Censys exposure research reported: 175,000 public Ollama hosts.

## Sources

1. [Wiz — Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032)](https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032)
2. [NVD — CVE-2024-37032](https://nvd.nist.gov/vuln/detail/CVE-2024-37032)
3. [Ollama (GitHub) — Release v0.1.34](https://github.com/ollama/ollama/releases/tag/v0.1.34)
4. [SecurityWeek — 175,000 Exposed Ollama Hosts Could Enable LLM Abuse](https://www.securityweek.com/175000-exposed-ollama-hosts-could-enable-llm-abuse/)

---
Source page: https://erroneo.us/security/briefs/ollama-probllama-path-traversal-rce-cve-2024-37032/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt