Probllama (CVE-2024-37032) — Ollama Path-Traversal RCE Postmortem

Ollama did not validate the model-manifest digest format, allowing path-traversal sequences that wrote arbitrary files; chaining /etc/ld.so.preload yielded code execution. Unauthenticated remote code execution — as root in default Docker setups — plus file read/overwrite and model theft/poisoning (CVSS 9.1, Critical). 1,000+ exposed instances. You are likely affected if you run Ollama < 0.1.34. at the versions noted in the record below. We can audit your cluster against this and the wider class of AI-infrastructure risks and tell you precisely where you are exposed.

Fix: Upgrade Ollama to 0.1.34 or later. Mitigation if you cannot patch immediately: If you cannot patch immediately, never expose Ollama directly to untrusted networks, run it non-root with a read-only root filesystem, restrict egress, and only pull models from trusted registries. We help you apply the fix safely in production — staged rollout, verification, and the admission/network guardrails that reduce blast radius for the next issue of this class.

Self-hosted inference runtimes are network services handling attacker-influenceable input (models and manifests). Treat them like any exposed service: validate input, run least-privilege, isolate the network, and keep them patched. This is why we treat the AI-infrastructure supply chain, container runtime, and admission path as security-critical — not just the application layer.

Yes. We run a focused review of your container runtime (NVIDIA Container Toolkit / GPU Operator versions), ingress and admission webhooks, model and image supply chain, agent/tool sandboxing, and RBAC/network policy — mapping each finding to a concrete fix and a guardrail. See our Kubernetes AI security hub.

Both. This page documents a real, publicly disclosed incident with its official source so you can act on it. If you would rather an engineer work it with you — patching safely in production, or auditing for the wider class of risk — that service is available same-day and confidentially.