Ollama is the most common way to run local models, and its Docker image often allows writing to the directory it loads components from. CERT Polska published a vulnerability on October 8 that combines both: with no authentication, an attacker can plant a file and get root execution on the next restart.
It is a relative path traversal vulnerability (CWE-23) in the /api/pull endpoint of Ollama, the one that downloads models from a registry. According to the CERT Polska advisory, the digestToPath function does not properly validate the digest of each model layer. An unauthenticated remote attacker can send a directory traversal sequence as the digest and get a malicious binary written outside the model store. The report credits Bartłomiej Dmitruk (striga.ai).
An arbitrary write on its own is not code execution. The jump comes from a deployment condition: if the server process can write to /usr/lib/ollama (which, according to CERT Polska, is the default in most Ollama Docker images), the attacker drops their file there. On the next server restart, that file is loaded and executed with root privileges. In other words, the attack has two phases: plant the file now, execute it when someone (or an orchestrator) restarts the container.
The requirement is that the API be reachable from an untrusted network. Ollama listens on port 11434 by default; if it is bound only to 127.0.0.1, exposure is much lower. The real risk is in installations where someone opened the service to 0.0.0.0 or published the Docker port without restricting it, for example on a cloud GPU VM to "try out a model". These installations usually have no authentication, because Ollama doesn't include it out of the box.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel