CVE-2025-63389

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.71%
EPSS Percentile: 52.64%
CISA KEV: Not listed

Description

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 18-Dec-2025 23:15
Last Modified: 13-Oct-2026 18:10
EPSS Date: 2026-10-20
CWE: CWE-306

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

ollama / ollama
Version / affected range: * · through (inclusive) 0.12.3
cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*

References

Last enrichment sync: 21-Oct-2026 04:16
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Ollama itself has multiple critical CVEs including missing authentication on all management operations (CVE-2025-63389). GreyNoise Report Highlights Edge Targeting, Fresh Attack Infrastructure and LLM Scanning

CVE (7)

Malware (1)

Threat Actors (2)

MITRE ATT&CK (5)

Vendors (10)

Products (5)

Tools (1)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.