GitHub Advisoryadvisory · Go

GHSA-f6mr-38g8-39rg Ollama Platform has missing authentication enabling attackers to perform model management operations

CRITICAL Published 2025-12-18 Modified 2025-12-18 Official page ↗
Aliases
CVE-2025-63389
Ecosystem
Go
Packages
github.com/ollama/ollama
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-284, CWE-306
Reviewed
2025-12-18

Affected packages

• Go github.com/ollama/ollama: <= 0.13.5 (no fix yet)

Description

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

Related

Alias · CVE (1)

  • CVE-2025-63389 A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References