CVE-2025-63389

Critical

Published: 18/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Critical authentication bypass vulnerability in Ollama platform's API endpoints up to v0.12.3. Multiple API endpoints are exposed without authentication, allowing remote attackers to perform unauthorized model management operations.

Risk Assessment

Attackers can modify, delete, or run models without authorization, potentially compromising service integrity and availability.

Recommendation

Update Ollama to a patched version and configure authentication for all API endpoints.

Original NVD description (English source)

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.