GHSA-f6mr-38g8-39rg

Ollama Platform has missing authentication enabling attackers to perform model management operations

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-63389

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/ollama/ollama	<= 0.13.5	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-63389 advisory
https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd web
https://github.com/ollama/ollama package
https://github.com/ollama/ollama/issues web