CVE-2026-42249: Ollama Windows Auto-Updater HTTP Header Path Traversal RCE

HERMES

HERMES THREAT SCORE & LOCAL AI RUNTIME TAKEOVER

Target: Ollama for Windows — Background Auto-Update Service & Desktop Staging Engine

Confidence: 96%

92 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 18 / 20

Weaponization 19 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 19 / 20

Exploit Maturity 19 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

While NVD rates CVE-2026-42249 in isolation at 7.7 (High), Hermes Threat Score elevates it to 92 (CRITICAL). In operational environments, this vulnerability chains seamlessly with CVE-2026-42248 (complete absence of binary signature verification in the Windows updater). Ollama is installed on millions of developer workstations, data science nodes, and enterprise AI testing systems. By manipulating update headers, attackers drop malicious executables directly into the Windows Startup directory, establishing silent, reboot-persistent execution with developer privileges.

HASS

HASS AGENTIC SEVERITY & AI WORKSTATION PERSISTENCE

Target: Local LLM Inference Engine, Proprietary Weight Repositories & Developer Secrets

Confidence: 92%

72 / 100

HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 14 / 20

Tool Access 15 / 20

Privilege 16 / 15

Persistence 15 / 15

External Impact 12 / 15

Propagation 14 / 15

⚖️ Divergence & Operational Rationale

Compromising the foundational local inference runtime gives adversaries access to internal model weights, unredacted prompts, and agentic workflows operating on developer endpoints. Attackers can hijack local inference APIs, exfiltrate fine-tuning datasets, and pivot across enterprise source code repositories.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-42249: Ollama Windows Auto-Updater HTTP Header Path Traversal RCEVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

High-Severity Exploit Chain Advisory

CVSS v3.1: 7.7 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) / CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’). When chained with CVE-2026-42248 (Unchecked Binary Signature Verification), the combined exploit chain achieves a practical impact of CVSS 9.8 Critical. Affects Ollama for Windows versions 0.12.10 through 0.17.5. Remediated in version 0.17.6. macOS and Linux distributions are unaffected due to platform-specific code signing and package manager isolation.

Executive Summary

Ollama is the leading local execution framework for open-weight large language models (Llama 3, DeepSeek, Mistral, Qwen), running as a background service on developer workstations. The Windows desktop edition features an automated background update mechanism designed to query remote endpoints and stage new executable releases without user friction.

CVE-2026-42249 discloses a critical path traversal vulnerability in how the Windows update client handles server metadata. When checking for new versions, the updater constructs the temporary destination file path by directly concatenating values returned in HTTP response headers (such as the ETag or Content-Disposition header) without directory traversal sanitization. A network-positioned adversary (via Man-in-the-Middle, DNS hijacking, or a rogue proxy) can inject ..\..\ path traversal sequences to write arbitrary executables outside the staging directory into the Windows Startup folder. Because the update client additionally fails to verify digital signatures on downloaded payloads (CVE-2026-42248), the dropped binary executes automatically upon user login, achieving silent, persistent host compromise.

---

1. Technical Architecture & Exploit Anatomy

The Ollama for Windows client runs a background tray monitor (ollama app.exe) that periodically checks the update API endpoint (https://ollama.com/api/update).

┌─────────────────────────┐                                 ┌─────────────────────────┐
│     Ollama Client       │ ──── GET /api/update ─────────> │   Upstream Server /     │
│   (Windows Tray App)    │                                 │   Adversary in the Mid  │
└────────────┬────────────┘ <─── Malicious HTTP Headers ─── └─────────────────────────┘
             │                   ETag: "../../../Startup/payload.exe"
             │                   (Or forged Content-Disposition)
             ▼
┌─────────────────────────┐
│ File Path Construction  │ ──> Constructs path without sanitization:
│                         │     C:\Users\<user>\AppData\Local\Ollama\Updates\..\..\
└────────────┬────────────┘     ..\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe
             │
             │ Drops arbitrary PE executable directly into Startup folder
             ▼
┌─────────────────────────┐
│ Signature Check Bypass  │ ──> CVE-2026-42248: VerifySignature() returns TRUE unconditionally
└────────────┬────────────┘
             │
             │ User logs on / System reboot occurs
             ▼
┌─────────────────────────┐
│  Arbitrary Code Exec    │ ──> payload.exe runs with interactive user privileges
│   (Persistent RCE)      │     Steals API keys, SSH keys, git credentials, model weights
└─────────────────────────┘

Parameter	Technical Specification	Operational Detail
CVE Identifier	CVE-2026-42249	Chained with CVE-2026-42248
Vulnerability Class	Path Traversal (CWE-22) / Insecure Code Download (CWE-494)	Directory escape in file write destination
Affected Platform	Windows (x64 / ARM64 builds)	macOS & Linux use native isolated updaters
Trigger Mechanism	Background HTTP update poll or manual update check	Periodic check triggered automatically
Exploit Vector	Man-in-the-Middle (MitM), poisoned CDN, malicious corporate proxy	Injected ETag / Content-Disposition header
Target Location	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp	Windows user / system persistence locations
Affected Releases	0.12.10 through 0.17.5	Confirmed vulnerable by independent researchers
Remediated Release	0.17.6+	Enforces filepath.Base() and Authenticode verification

---

2. Root Cause Analysis: Unsanitized Header Concatenation

The Path Construction Flaw

During update staging, Ollama’s Go backend on Windows retrieved the remote file identifier from the HTTP headers and joined it directly with the temporary updates directory:

// Vulnerable path construction in Ollama Windows updater (Go runtime)
// app/lifecycle/updater_windows.go (prior to v0.17.6)

func stageUpdate(resp *http.Response) (string, error) {
    // Extract ETag header used as unique cache/file identifier
    etag := resp.Header.Get("ETag")
    if etag == "" {
        etag = "ollama_update.exe"
    }

    // Strip optional quotes
    etag = strings.Trim(etag, "\"")

    // CRITICAL FLAW: Direct filepath.Join without verifying that etag does not contain ".."
    updateDir := filepath.Join(os.Getenv("LOCALAPPDATA"), "Ollama", "Updates")
    destPath := filepath.Join(updateDir, etag)

    out, err := os.OpenFile(destPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755)
    if err != nil {
        return "", err
    }
    defer out.Close()

    _, err = io.Copy(out, resp.Body)
    return destPath, err
}

Because filepath.Join evaluates .. segments, providing an ETag such as: "../../../../Microsoft/Windows/Start Menu/Programs/Startup/ollama_helper.exe" causes destPath to resolve out of LOCALAPPDATA\Ollama\Updates\ directly into the user’s active startup folder.

The Chained Failure: CVE-2026-42248 (No Authenticode Verification)

Once staged, the client attempted to verify the executable’s Authenticode digital signature before execution. However, in the Windows code path, the verification stub was either commented out during cross-compilation or always returned a success status:

// Stubbed verification in updater_windows.go
func verifySignature(filePath string) error {
    // TODO: implement full WinVerifyTrust API bindings
    return nil // Insecure bypass: always returns success
}

The updater marked the file as verified and ready for invocation, completing the zero-click RCE chain.

---

3. Real-World Attack Scenarios

Attack Vector: Compromised Egress / Rogue Local Proxy

1. Network Position: An adversary compromises a local Wi-Fi router (e.g., in a coffee shop, hotel, or corporate guest network) or poisons DNS resolution for ollama.com.
2. Traffic Interception: The adversary intercepts the plain or TLS-stripped HTTP update check from Ollama for Windows.
3. Response Crafting: The attacker returns an HTTP 200 response with a forged header:

   HTTP/1.1 200 OK
   Content-Type: application/octet-stream
   ETag: "../../../Microsoft/Windows/Start Menu/Programs/Startup/SecurityHealthSystray.exe"
   Content-Length: 45056
   
   <Malicious PE Binary Payload>

4. File Drop: The Ollama background process writes the PE binary into the victim’s Startup folder.
5. Persistence & Execution: The next time the developer logs in or reboots, Windows Explorer automatically launches SecurityHealthSystray.exe, executing the attacker’s payload.

---

4. DFIR Forensic Markers & Investigation

Forensic analysts investigating potential exploitation of CVE-2026-42249 on Windows developer workstations should analyze the following core artifacts:

1. Startup Directory Inspection

Check for unexpected binaries created in the user and system startup folders:

• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
• %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
• Look for creation timestamps matching Ollama network update activity.

2. Prefetch (.pf) & Shimcache Artifacts

• Check for prefetch files corresponding to dropped binaries in C:\Windows\Prefetch\. Refer to our Prefetch Forensic Analysis Guide to confirm execution counts and timestamps.
• Inspect the Windows AppCompatCache (Shimcache) to confirm if the dropped binary executed prior to remediation. See our Shimcache Deep Dive.

3. Windows Event Logs

• Event ID 4688 (Process Creation): Search for processes created with ollama app.exe as the parent, or suspicious executables originating from the Startup folder. Refer to our Process Lineage Analysis Guide.
• Event ID 7045 (Service Creation): If the attacker leveraged access to install a persistent service. See Event 7045 & 4698 Forensics.

---

5. Detection Engineering

Sigma

title: Ollama Process Dropping Executable into Windows Startup Folder
id: 4f5a6b7c-8d9e-0f1a-2b3c-4d5e6f7a8b9c
status: experimental
description: Detects the Ollama for Windows process writing or dropping PE executables directly into Startup directories, indicative of CVE-2026-42249 exploitation.
references:
  - https://hermes-codex.vercel.app/cve/2026/cve-2026-42249/
  - https://nvd.nist.gov/vuln/detail/CVE-2026-42249
author: Hermes Codex Tactical Forensics
date: 2026-09-18
logsource:
  category: file_event
  product: windows
detection:
  selection_initiator:
    Image|endswith:
      - '\ollama app.exe'
      - '\ollama.exe'
  selection_target:
    TargetFilename|contains:
      - '\Start Menu\Programs\StartUp\'
      - '\Start Menu\Programs\Startup\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.vbs'
      - '.ps1'
  condition: selection_initiator and selection_target
level: critical
tags:
  - attack.persistence
  - attack.t1547.001
  - cve.2026-42249

PowerShell Triage Script

# Hermes Triage: Audit Ollama Update directory and Windows Startup items
Write-Host "[-] Auditing Ollama Update directory..." -ForegroundColor Cyan
$OllamaUpdateDir = "$env:LOCALAPPDATA\Ollama\Updates"
if (Test-Path $OllamaUpdateDir) {
    Get-ChildItem -Path $OllamaUpdateDir -Recurse | Select-Object FullName, Length, CreationTime, LastWriteTime | Format-Table -AutoSize
}

Write-Host "[-] Auditing User Startup Folder..." -ForegroundColor Cyan
$UserStartup = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
Get-ChildItem -Path $UserStartup | Select-Object Name, Length, CreationTime, LastWriteTime | Format-Table -AutoSize

Write-Host "[-] Auditing Global Startup Folder..." -ForegroundColor Cyan
$GlobalStartup = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
Get-ChildItem -Path $GlobalStartup | Select-Object Name, Length, CreationTime, LastWriteTime | Format-Table -AutoSize

KQL (Microsoft Defender for Endpoint)

// Detect file creations by Ollama in Startup folders
DeviceFileEvents
| where InitiatingProcessFileName in~ ("ollama app.exe", "ollama.exe")
| where FolderPath has @"Start Menu\Programs\Startup"
| where ActionType == "FileCreated"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256
| order by TimeGenerated desc

---

6. Remediation & Hardening Strategies

Immediate Remediation

1. Upgrade to Ollama 0.17.6+: Download the latest verified Windows installer from the official repository:

   winget upgrade Ollama.Ollama

2. Verify Startup Items: Inspect shell:startup and shell:common startup and remove any unrecognized binaries dropped during recent update checks.
3. Disable Automatic Updates (Interim Workaround): If upgrading cannot be immediately performed, disable automatic updates in the Ollama configuration or block outbound connections to ollama.com/api/update via Windows Defender Firewall.

Enterprise Hardening

• AppLocker / Windows Defender Application Control (WDAC): Prevent execution of unsigned binaries located in user-writable directories (%LOCALAPPDATA%, StartUp).
• TLS Inspection & Certificate Pinning: Ensure network inspection tools enforce valid TLS certificates for all developer tooling update endpoints.

---

7. Strategic Cross-References

Windows Event 7045 & 4698 Forensics Investigating service installations and scheduled tasks used for persistent malware staging.

LNK Files & Windows Shortcuts Forensics Detailed forensic guide to analyzing startup shortcuts and execution metadata.

Prefetch (.pf) Files Forensic Analysis Proving binary execution and determining precise incident timelines on Windows.

Amcache & RecentFileCache Forensics Extracting SHA1 hashes and execution traces of dropped malicious binaries.

---

8. Sources & References

• NVD Vulnerability Record: CVE-2026-42249 Detail
• Ollama Official Releases: Ollama GitHub Releases
• Help Net Security: Ollama for Windows Vulnerabilities Enable Remote Code Execution (May 2026)
• CERT Polska Technical Advisory: Path Traversal in Desktop Client Auto-Updaters (2026)