External risk intelligence

Ollama API Authentication Bypass Allows Unauthorized Model Management.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-63389

Ollama is a platform used to serve AI models via API endpoints. These services are commonly deployed to be reachable over the network to allow remote clients or applications to interact with the models. Given that the vulnerability resides in these API endpoints which are intended for service interaction, they are frequently exposed in network-reachable configurations.

Missing Authentication

Ollama

0.12.3 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Ollama platform's API could allow unauthorized users to manage AI models remotely. This issue affects network-accessible services that interact with these models, raising concerns about potential misuse of AI capabilities. The primary focus should be on determining if your organization utilizes Ollama and if its API endpoints are exposed externally.

Unauthenticated API access to manage AI models.
Potential for unauthorized AI model control.
Confirm Ollama usage and API exposure.

Attack Path

How an attacker could exploit the issue

Attackers can remotely access Ollama platform's API endpoints because they lack authentication, allowing them to manage models without authorization. This bypass enables unauthorized actions, potentially leading to significant security breaches.

No authentication required for API access.
API endpoints trigger the vulnerability.
Unauthorized model management is possible.

Live Threat

Current exploitation, exposure, and threat context

The Ollama platform's API endpoints could be accessed remotely without authentication, potentially allowing unauthorized users to manage AI models. This could impact the integrity and availability of the platform's model management functions when these API endpoints are exposed externally.

Unauthorized model management operations.
Remote attackers can access API endpoints.
Disruption of model availability and integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Ollama platform's API endpoints are likely managed by platform or infrastructure teams, with oversight from security and vendor management teams if it's a third-party offering. The first practical step is to identify all instances of Ollama, determine their network reachability and business criticality, and then assign ownership for remediation planning.

Platform or infrastructure teams own the issue.
Verify network exposure and criticality of Ollama.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ollama platform?

Ollama is a software platform designed to run and serve large language models locally. Developers and organizations use it to host AI models, allowing applications to interact with these models through its built-in API endpoints for tasks like model management and inference.

What does CWE-306 mean for CVE-2025-63389?

CWE-306 identifies a 'Missing Authentication for Critical Function' weakness. In the context of this CVE, it means the Ollama API fails to verify the identity of a user or system before executing commands. Because of this flaw, the platform assumes that anyone sending a request is authorized, allowing unauthorized parties to interact with the API endpoints.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending unauthorized network requests directly to the Ollama API endpoints. The vulnerability is specifically tied to the lack of access controls on these interfaces. It is important to note that actions performed through legitimate, authorized administrative interfaces—if any were to exist separately—do not trigger this specific API-based bypass.

Is my instance of Ollama at risk?

According to Halo Surface Signal, risk depends heavily on how you have deployed the service. Because Ollama is designed to be reachable over a network, instances that are configured to be internet-facing or accessible to unauthorized network segments are at the highest risk. Internal instances protected by network segmentation may have a reduced surface area.

What should I do if I use Ollama?

Begin by auditing your infrastructure to locate all instances of Ollama. Once identified, evaluate whether these instances are exposed to the internet or untrusted networks. If they are exposed, coordinate with your infrastructure or platform teams to restrict access to these endpoints while you evaluate the available updates or security configurations provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.