{"id":"CVE-2026-59158","revision":"69a380863dfd47e7acfa1db07b8cd0fa","records":[{"revision":"69a380863dfd47e7acfa1db07b8cd0fa","observedAt":"2026-10-27T23:45:55.339+00:00","statement":{"source":"cve-program","id":"CVE-2026-59158","aliases":[],"title":"Nuxt Ollama: public runtime configuration discloses the configured cloud API key","description":"Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.","state":0,"publishedAt":"2026-10-27T22:36:09.75+00:00","modifiedAt":"2026-10-27T22:36:09.75+00:00","affected":[{"ecosystem":"Vendor product","name":"nuxt-ollama","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"thoda-dev\",\n                    \"product\": \"nuxt-ollama\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.3.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/thoda-dev/nuxt-ollama/security/advisories/GHSA-fxg7-897c-57mp","https://github.com/thoda-dev/nuxt-ollama/commit/156e813783ef322ee10dbbdd6bf446a449e1a04f","https://github.com/thoda-dev/nuxt-ollama/releases/tag/v1.3.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59158","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-59158","identifiers":["CVE-2026-59158"]},"retained":false,"historicalAffected":[]}],"coverage":[]}