CVE-2025-63389

Katalog CVE

CVSS 9.8 · Critical EPSS 0,71%

Kerentanan Missing Authentication for Critical Function pada ollama. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

Rincian

Terbit di NVD

18 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd advisory pihak ketiga
• https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7
• https://github.com/ollama/ollama/issues issue tracking