PT-2025-54499 · Go · Github.Com/Ollama/Ollama

Publicado 2025-12-18 · Atualizado 2025-12-18

OSV

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

Correção

Missing Authentication

Improper Access Control

Enumeração de Fraquezas

CWE-306

CWE-284

Identificadores relacionados

GHSA-F6MR-38G8-39RG

Produtos afetados

Github.Com/Ollama/Ollama

Referências · 5

• https://github.com/ollama/ollama · Nota
• https://github.com/ollama/ollama/issues · Nota
• https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd · Nota
• https://osv.dev/vulnerability/GHSA-f6mr-38g8-39rg · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-63389 · Nota de Segurança