GitHub Advisoryadvisory · Go

GHSA-x9hg-5q6g-q3jr Ollama vulnerable to Cross-Domain Token Exposure

MEDIUM Published 2025-07-22 Modified 2026-06-06 Official page ↗
Aliases
CVE-2025-51471
Ecosystem
Go
Packages
github.com/ollama/ollama
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Weaknesses
CWE-345
Reviewed
2025-07-22

Affected packages

• Go github.com/ollama/ollama: <= 0.9.6 (no fix yet)

Description

Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.

Related

Alias · CVE (1)

  • CVE-2025-51471 Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and… vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References