Description
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.
Affected products
ollama: ollama
References3
- gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd Third Party Advisory
- gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7
- github.com/ollama/ollama/issues Issue Tracking
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 54 · as of 11 November 2026
- CWE
- CWE-306
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.