CVE-2026-111702 in ChatOllama
Summary
by MITRE • 10/16/2026
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The identified security flaw resides within ChatOllama, specifically introduced in commit 96c3ce5, where the application fails to implement proper access control mechanisms for private user resources. This vulnerability is classified as an Insecure Direct Object Reference, commonly known by its CWE identifier CWE-639. The core technical issue stems from the system's reliance on sequential identifiers to reference knowledge bases without verifying that the requesting authenticated user owns or has permission to access those specific objects. Consequently, the application trusts client-supplied input for object identification rather than validating it against an authorization matrix tied to the current session context.
Remote attackers can exploit this lack of ownership verification by manipulating the identifier parameters in API requests. By supplying sequential integer values instead of valid user-specific identifiers, an attacker can iterate through potential knowledge base IDs. This enumeration is facilitated primarily through two endpoints: a GET request to /api/knowledgebases/{id} and the knowledgebaseId parameter within POST /api/models/chat requests. The vulnerability allows for both metadata retrieval and the extraction of actual document content stored within these private repositories, effectively bypassing intended privacy boundaries between different users on the same instance.
The operational impact of this vulnerability is severe, as it leads to a complete compromise of data confidentiality for all users sharing the ChatOllama environment. Since knowledge bases often contain sensitive proprietary information, personal data, or confidential research materials, unauthorized access constitutes a significant breach of privacy and intellectual property rights. Attackers do not need complex exploitation techniques; they merely require valid authentication credentials for any user account to perform systematic enumeration attacks against other users' private data stores. This scenario aligns with the ATT&CK technique T1078, which covers Valid Accounts, as well as aspects of information gathering and lateral movement within a multi-tenant application context where one tenant can access another's resources due to flawed isolation logic.
To mitigate this vulnerability, developers must enforce strict object-level authorization checks on all API endpoints that handle resource retrieval or modification. The system should validate the association between the authenticated user session and the requested knowledge base ID before processing any request. Implementing random, non-sequential identifiers such as UUIDs can also reduce the efficiency of enumeration attacks by increasing the search space for attackers, although this is a secondary defense-in-depth measure rather than a primary fix. The immediate priority must be patching the access control logic to ensure that every read operation verifies ownership permissions against the database records associated with the current user's identity.