Bug 2423607 (CVE-2025-63389)

Summary: CVE-2025-63389 Ollama: Ollama: Unauthorized model management via authentication bypass in API endpoints
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Ollama. This critical authentication bypass vulnerability allows remote attackers to perform unauthorized model management operations. The platform exposes multiple API endpoints without requiring authentication, enabling attackers to manipulate models without proper authorization.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2424258, 2424259    
Bug Blocks:    

Description OSIDB Bzimport 2025-12-18 16:02:30 UTC
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.