GHSA-f6mr-38g8-39rg

Source

https://github.com/advisories/GHSA-f6mr-38g8-39rg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-f6mr-38g8-39rg/GHSA-f6mr-38g8-39rg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f6mr-38g8-39rg

Aliases

Downstream

MINI-gwpm-gjp3-m584

Related

Published

2025-12-18T18:30:30Z

Modified

2026-02-04T03:44:49.962457Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Ollama Platform has missing authentication enabling attackers to perform model management operations

Details

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

Database specific

{
    "nvd_published_at": "2025-12-18T16:15:54Z",
    "cwe_ids": [
        "CWE-284",
        "CWE-306"
    ],
    "github_reviewed_at": "2025-12-18T22:49:16Z",
    "severity": "CRITICAL",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/ollama/ollama

Package

Name: github.com/ollama/ollama; View open source insights on deps.dev
Purl: pkg:golang/github.com/ollama/ollama

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.13.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-f6mr-38g8-39rg/GHSA-f6mr-38g8-39rg.json"