CVEvulnerability
CVE-2025-63389
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2025-12-18
- Last modified
- 2026-10-13
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-306
Description
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.
Affected configurations
• ollama ollama (<= 0.12.3)
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd Third Party Advisory
- https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7 gist.github.com
- https://github.com/ollama/ollama/issues Issue Tracking