CVE-2025-63389: Critical severity Ollama Ollama platform vulnerability
Published Dec 18, 2025
·Updated
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.
Affected Software
3 affected components
Ollama Ollama platform<=0.12.3
go/github.com/ollama/ollama<=0.13.5
Ollama Ollama<=0.12.3
Event History
Dec 18, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:30 PM
Data Sourced
via GitHub·06:30 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-63389?
CVE-2025-63389 is classified as a critical vulnerability.
2
How can I fix CVE-2025-63389?
To fix CVE-2025-63389, upgrade to Ollama platform version 0.12.4 or later.
3
What impacts does CVE-2025-63389 have on my system?
CVE-2025-63389 allows unauthorized remote access to model management operations via exposed API endpoints.
4
Which versions of the Ollama platform are affected by CVE-2025-63389?
The affected versions of the Ollama platform are prior to and including v0.12.3.
5
Is my configuration safe if I use the Ollama platform after v0.12.3 due to CVE-2025-63389?
Using the Ollama platform after v0.12.3 should secure your configuration from CVE-2025-63389.