CVE-2025-63389

Published: Dec 18, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

Affected (1)

Products: Ollama: Ollama

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ollama Ollama	Up to 0.12.3

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (3)

https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd

Source: cve@mitre.org

Third Party Advisory

https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7

Source: cve@mitre.org

https://github.com/ollama/ollama/issues

Source: cve@mitre.org

Issue Tracking

Timeline

No history available yet.