Loading story…
CERT Polska disclosed two vulnerabilities in Ollama for Windows—CVE-2026-42248 and CVE-2026-42249—that affect tested versions 0.12.10 through 0.17.5 and expose the software’s update mechanism to malicious payloads. According to the advisory, the first flaw causes the Windows updater to accept downloaded executables without properly verifying their integrity or authenticity, while the second lets attacker-controlled HTTP response headers influence file path construction, enabling path traversal and arbitrary file writes. CERT Polska said an attacker able to tamper with update responses could combine the bugs to stage and run unauthorized code during Ollama’s silent automatic update process.
The chained attack could allow malicious executables to be written into sensitive locations such as the Windows Startup directory, resulting in automatic and persistent code execution without user awareness. CERT Polska credited Bartłomiej Dmitruk of striga.ai with the report and said maintainers were notified early, but no vendor details on the vulnerabilities or affected versions were provided. Separate reporting later listed the Ollama issues among a broader set of publicly validated CVEs attributed by Striga’s tracker, while noting that the AI-assisted discovery claims were self-reported rather than independently confirmed by upstream vendors.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Apache HTTP Server fixed heap-underflow vulnerability CVE-2026-44631 in version 2.4.68 and credited DepthFirst and Bartlomiej Dmitruk of Striga for the report. The source does not specify the date the fix was released.
CERT Polska disclosed two vulnerabilities affecting Ollama for Windows and stated both CVEs were published on 2026-04-29. The flaws allow malicious update payload execution and, when chained, can enable persistent remote code execution via the Windows Startup directory.
CERT Polska said Ollama maintainers were notified early about two Windows update-mechanism vulnerabilities, later tracked as CVE-2026-42248 and CVE-2026-42249. The notice does not provide a specific date for when the report was sent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
bugflation.com
Open sourcebugflation.com
Open sourcecert.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple serious security issues affecting AI tooling, led by critical vulnerabilities in **Ollama** that can expose systems and data. Wiz reported `CVE-2024-37032` (**Probllama**), an easy-to-exploit remote code execution flaw caused by improper validation of model manifests from private registries, allowing path traversal, arbitrary file read/write, and code execution—especially in Docker deployments running as root and listening on `0.0.0.0` without authentication. A separate disclosure described `CVE-2026-7482` (**Bleeding Llama**), which can leak heap memory through Ollama’s GGUF model creation and quantization workflow and exfiltrate the resulting artifact via the `/api/push` endpoint, while `CVE-2026-42248` and `CVE-2026-42249` affect the Windows updater and can be chained for persistent code execution through missing signature checks and unsafe `ETag` handling. The disclosures landed alongside a software supply chain incident on **Hugging Face**, where a malicious repository impersonating OpenAI’s Privacy Filter reportedly climbed to the platform’s trending list and drew more than 240,000 downloads before removal. The fake package used cloned documentation and likely inflated engagement metrics to appear legitimate, then delivered a multi-stage Windows infection that gained **SYSTEM**-level persistence, disabled security controls, and deployed the Rust-based stealer **sefirah** to collect wallet data, Discord tokens, developer credentials, browser secrets, screenshots, and sensitive files for exfiltration. Together, the incidents show how exposed AI infrastructure, weak authentication defaults, and trust in popular model and code repositories are creating high-impact attack paths; defenders were urged to upgrade Ollama to fixed versions, avoid direct internet exposure, use authenticated reverse proxies, and scrutinize third-party AI packages before deployment.
Jun 29, 2026
Oligo Security disclosed six issues in **Ollama**, the open-source platform for serving large language models locally and remotely. Four received CVE identifiers: `CVE-2024-39719`, `CVE-2024-39720`, `CVE-2024-39721`, and `CVE-2024-39722`. The reported flaws affect the CreateModel and push APIs and can allow application crashes, resource-exhaustion denial of service, and disclosure of whether files exist on the host. Ollama fixed `CVE-2024-39720`, `CVE-2024-39721`, and `CVE-2024-39722` in version 0.1.46, while Oligo said `CVE-2024-39719` remained unresolved in version 0.3.14. Oligo also identified unauthenticated pull and push management endpoints as potential routes for model poisoning and model theft, although Ollama maintainers disputed those findings as vulnerabilities. The researchers estimated about 10,000 internet-exposed Ollama IP addresses and assessed roughly one quarter as vulnerable to the reported issues.
Sep 3, 2026
Sysdig researchers observed a threat actor abusing a publicly exposed, unauthenticated **Ollama** server as the reasoning backend for an automated offensive framework dubbed **VAPT**. The tool chained AI-driven stages to fingerprint services, map vulnerabilities, generate proof-of-concept exploits, craft blind SQL injection payloads, extract credentials, plan file reads, and choose privilege-escalation paths until remote command execution was achieved. Researchers said the activity marks an evolution of **LLMjacking**, shifting from theft of paid inference APIs to theft of self-hosted model capacity for autonomous offensive operations. The observed sessions originated from residential IP addresses in India and targeted only private lab-style ranges and fictitious applications, indicating the actor was likely developing and tuning the framework rather than attacking public victims during the observation window. Sysdig said many Ollama deployments remain exposed because the service listens on port `11434` without authentication by default, with roughly **175,000** instances reportedly reachable across more than **130 countries**. The company urged defenders to block internet exposure, add authentication through proxies or network controls, and monitor model endpoints for offensive-tooling markers such as the strings `VAPTb3gin`, `VAPTfin`, and the command: ```bash echo VAPTb3gin; id; echo VAPTfin ```
Jul 12, 2026