VulnerabilityModified

CVE-2025-63389

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3.

CRITICAL 9.8EPSS 0.72%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.72% probability · 52th percentile
CISA KEV: Not listed
Weakness: CWE-306
Affected: ollama/ollama
Source: cve@mitre.org

References

https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecdThird Party Advisory
https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7
https://github.com/ollama/ollama/issuesIssue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.