A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to …

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-63389 · Microsoft / collected KEV context

EUVD-2025-204310

GHSA-f6mr-38g8-39rg

GO-2025-4251

cve-program · CVE-2025-63389

• https://github.com/ollama/ollama/issues
• https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd
• https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7

euvd · EUVD-2025-204310

• https://github.com/ollama/ollama/issues
• https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd
• https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7

nvd · CVE-2025-63389

• https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd
• https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7
• https://github.com/ollama/ollama/issues

osv · GHSA-f6mr-38g8-39rg

• https://nvd.nist.gov/vuln/detail/CVE-2025-63389
• https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd
• https://github.com/ollama/ollama
• https://github.com/ollama/ollama/issues

osv · GO-2025-4251

• https://github.com/advisories/GHSA-f6mr-38g8-39rg
• https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd
• https://github.com/ollama/ollama/issues

No related operational record is retained in the current change model.