Ollama Windows auto-updater missing signature verification
Date: 2026-05
Affected: Ollama Windows (auto-updater)
Attack vector: supply-chain
Category: real-world
Severity: Critical
CVE: CVE-2025-15514
CVE-2026-42248
CVE-2026-42249
CVE-2026-5757
CWE: CWE-125
CWE-22
CWE-395
CWE-494
CVSS: 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Ollama for Windows auto-updater's signature verification function exists and is called but does nothing, allowing any downloaded payload to be executed. Persistent RCE vector via the updater channel.


Mitigations:

Architectural layers (MAESTRO):