{"id":"CVE-2025-63389","sourceIdentifier":"cve@mitre.org","published":"2025-12-18T16:15:54.760","lastModified":"2026-10-13T11:10:00.203","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations."},{"lang":"es","value":"Una crítica vulnerabilidad de omisión de autenticación existe en los endpoints de la API de la plataforma Ollama en versiones anteriores e incluyendo la v0.12.3. La plataforma expone múltiples endpoints de la API sin requerir autenticación, lo que permite a atacantes remotos realizar operaciones de gestión de modelos no autorizadas."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-19T17:35:48.329098Z","id":"CVE-2025-63389","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*","versionEndIncluding":"0.12.3","matchCriteriaId":"ECF7F9A4-2538-4FCE-8BBB-7EB95E91D756"}]}]}],"references":[{"url":"https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7","source":"cve@mitre.org"},{"url":"https://github.com/ollama/ollama/issues","source":"cve@mitre.org","tags":["Issue Tracking"]}]}