by Kastro
Paper/Archive/CVE-2025-63389

CVE-2025-63389

mitre — A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3.

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.5.535 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/ollama/ollama/issuesrefgist.github.com/Cristliu/48dae561696374744d9fced07a544ecdrefgist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7