Ollama CVE-2025-63389

Requires the Ollama HTTP API (default TCP port 11434) to be reachable by the attacker. Ollama binds to 127.0.0.1 by default, so remote exploitation is only possible when an operator has explicitly exposed the API to a network interface (e.g., setting OLLAMA_HOST to 0.0.0.0 / a routable address) or placed it behind a reverse proxy with no authentication. Once the endpoint is reachable, no credentials, tokens, or user interaction are needed because Ollama implements no authentication on these endpoints. The primary limiting factor is this non-default network exposure; default localhost-only installations are not remotely exploitable.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) describes a trivially exploitable, unauthenticated, network-reachable critical flaw. However, these signals should be read with caution. No EPSS score, no CISA KEV listing, and no vendor-confirmed POC flag were provided in the input, so there is no positive evidence of in-the-wild or widespread automated exploitation. More importantly, the CVSS 9.8 almost certainly overstates real-world risk: Ollama by default binds its API to localhost (127.0.0.1:11434) and ships with no authentication by design, so the AV:N/PR:N 'remote unauthenticated' premise only holds when an operator has deliberately exposed the API to a network interface (e.g., OLLAMA_HOST=0.0.0.0 or a reverse proxy). The characterization as an 'authentication bypass' is debatable given Ollama intentionally has no auth layer - this is better understood as missing authentication (CWE-306) on an exposed service. The stated impact ('unauthorized model management operations' - pulling, deleting, creating models) supports integrity and availability impact (model deletion, disk exhaustion) but the C:H confidentiality claim is weakly justified by the description. Net: a genuine concern for anyone who has network-exposed an Ollama instance, but likely closer to a configuration/exposure issue than a universally critical remote compromise. Treat as medium-high priority for exposed deployments, lower for default localhost-only installs.

An operator runs Ollama with its API bound to a network interface (OLLAMA_HOST set to 0.0.0.0 or exposed via a proxy without auth). A remote attacker who can reach TCP port 11434 sends unauthenticated API requests to model-management endpoints, allowing them to pull, create, or delete models without any credentials. Referenced public gists appear to document the technique, but no vendor- or CISA-confirmed exploit code is recorded in the input.