CVE-2026-42249: 
NixOS vulnerability analysis and mitigation

CVE-2026-42249 is a Remote Code Execution (RCE) vulnerability in Ollama for Windows affecting its automatic update mechanism. The flaw arises from improper handling of attacker-controlled HTTP response headers during update downloads, enabling path traversal attacks that allow arbitrary files to be written outside the intended staging directory. Tested and confirmed vulnerable versions span from 0.12.10 to 0.17.5; other versions may also be affected. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory). It was published on April 29, 2026, with the project maintainers reportedly unresponsive to early disclosure (GitHub Advisory).

The root cause is classified as CWE-22 (Path Traversal) and CWE-494 (Download of Code Without Integrity Check). When Ollama for Windows downloads updates, it constructs local file paths using values derived from HTTP response headers (such as ETag) without sanitization, passing them directly to Go's filepath.Join. This allows an attacker who can intercept or spoof update HTTP responses to inject path traversal sequences (../) that resolve to locations outside the intended update staging directory — including the Windows Startup folder. When chained with CVE-2026-42248 (missing signature verification for updates), an attacker can deliver unsigned malicious executables that are silently written to sensitive locations and automatically executed without user interaction (GitHub Advisory, Striga Research).

Successful exploitation allows an unauthenticated attacker to write arbitrary executables to attacker-chosen locations on the victim's Windows system, including the Startup directory, resulting in persistent code execution with the privileges of the Ollama process. Because Ollama performs silent automatic updates without user interaction, malicious payloads execute automatically and persistently without any user awareness. The full confidentiality, integrity, and availability of the affected system are at risk, and the persistence mechanism enables long-term access and potential lateral movement (GitHub Advisory, Help Net Security).

A fully functional Metasploit module (ollama_update_etag_traversal.rb) implementing the complete exploitation chain — including HTTP server setup, payload generation, and persistence mechanisms — was added to the Metasploit Framework on May 8, 2026 (Metasploit). Exploitation has been reported by multiple sources, including hackerworkspace.com, and a proof-of-concept is publicly available (GitHub Advisory). The EPSS score is approximately 0.034% (0.265% per GitHub Advisory), and no CISA KEV catalog listing has been identified at this time. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify Windows hosts running Ollama versions 0.12.10 through 0.17.5 that have automatic updates enabled and are reachable on the network.
2. Position for interception: Establish a network-level man-in-the-middle (MitM) position between the target host and Ollama's update server (e.g., via ARP spoofing, rogue DNS, or compromised network infrastructure on the same segment).
3. Intercept update check: Wait for or trigger Ollama's silent automatic update check. The client will send an HTTP request to the update endpoint.
4. Craft malicious HTTP response: Respond with a crafted HTTP response containing a manipulated header value (e.g., ETag or Content-Disposition) that includes path traversal sequences such as ../../AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/malicious.exe.
5. Deliver malicious payload: Serve a malicious executable as the update payload. Because Ollama does not verify update signatures (CVE-2026-42248), the binary is accepted without integrity checks.
6. Trigger persistence: The malicious executable is written to the Windows Startup directory via the traversed path. On the next user login or system restart, the payload executes automatically with the user's privileges, establishing persistent access (GitHub Advisory, Metasploit).

• Network: Unexpected HTTP responses to Ollama update requests containing path traversal sequences (../) in header values (e.g., ETag, Content-Disposition); outbound connections from the Ollama process to unknown or non-official update servers; unusual DNS resolutions for Ollama update endpoints.
• File System: Unexpected executable files written to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\; new or modified files in the Ollama update staging directory with unusual names or paths; executables in user-accessible directories with recent write timestamps coinciding with Ollama update activity.
• Logs: Windows Event Logs showing new processes spawned from the Startup directory with parent process linked to Ollama; file creation events (Sysmon Event ID 11) in Startup directories attributed to the Ollama process; network connection logs (Sysmon Event ID 3) showing Ollama connecting to non-standard update hosts.
• Process: Unexpected child processes spawned by the Ollama Windows service or update handler; persistence-related processes (e.g., reverse shells, RATs) launching at user login from the Startup folder (GitHub Advisory, Metasploit).

Update Ollama for Windows to a version beyond 0.17.5 as soon as a patched release is available. As an interim workaround, disable automatic updates in Ollama if the option is available, and manually control update delivery. Restrict outbound network connections from the Ollama process to only legitimate update servers using host-based firewall rules or network segmentation. Monitor network traffic for anomalous update responses and validate update sources (GitHub Advisory, Help Net Security).

Help Net Security covered the vulnerability on May 5, 2026, highlighting the chained risk with CVE-2026-42248 and the silent, persistent nature of exploitation (Help Net Security). The Striga AI research team published a dedicated technical write-up on the Ollama Windows auto-update RCE chain (Striga Research). The vulnerability was also featured in The Hacker News weekly recap and discussed on security-focused social media platforms including Mastodon and Bluesky. The CERT Polska (CERT.PL) published a related advisory covering the companion vulnerability CVE-2026-42248 (CERT.PL). Community sentiment reflects concern over the maintainers' lack of response to responsible disclosure and the availability of a weaponized Metasploit module.