GHSA-f6mr-38g8-39rg

ghsaUSosv

Ollama Platform has missing authentication enabling attackers to perform model management operations

view advisory published 2025-12-18Licence: CC-BY-4.0

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-63389US	—OT elevated	0.71% (53rd)	—	2025-12-18
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints wit…

references

External citations — patches, advisories, analysis.

https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecdWEB
https://github.com/ollama/ollamaPACKAGE
https://github.com/ollama/ollama/issuesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-63389ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan