CVE-2025-63389criticalBroken access control2025-12-18
CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operations
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.
What it is
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.
How to check
- Affected: github.com/ollama/ollama (go) <= 0.13.5.
- Compare your installed version with the range above (command below).
How to fix
- No patched version of github.com/ollama/ollama is listed yet. Follow the advisory for mitigations.
ollama --versionSources
More advisories for this tool