CVE-2025-63389

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd	Third Party Advisory
https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7
https://github.com/ollama/ollama/issues	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*

History

13 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Una crítica vulnerabilidad de omisión de autenticación existe en los endpoints de la API de la plataforma Ollama en versiones anteriores e incluyendo la v0.12.3. La plataforma expone múltiples endpoints de la API sin requerir autenticación, lo que permite a atacantes remotos realizar operaciones de gestión de modelos no autorizadas.

Information

Published : 2025-12-18 16:15

Updated : 2026-10-13 11:10

NVD link : CVE-2025-63389

Mitre link : CVE-2025-63389

CVE.ORG link : CVE-2025-63389

JSON object : View

Products Affected

ollama

ollama

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-63389", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-63389", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-19T17:35:48.329098Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-18T16:15:54.760", "references": [{"url": "https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7", "source": "cve@mitre.org"}, {"url": "https://github.com/ollama/ollama/issues", "tags": ["Issue Tracking"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations."}, {"lang": "es", "value": "Una cr\u00edtica vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n existe en los endpoints de la API de la plataforma Ollama en versiones anteriores e incluyendo la v0.12.3. La plataforma expone m\u00faltiples endpoints de la API sin requerir autenticaci\u00f3n, lo que permite a atacantes remotos realizar operaciones de gesti\u00f3n de modelos no autorizadas."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECF7F9A4-2538-4FCE-8BBB-7EB95E91D756", "versionEndIncluding": "0.12.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}