CVE-2025-51471

Published July 22nd, 2025

View on NVD ↗

CVSS v3

6.9

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.

ollama/ollama

Get up and running with Kimi-K2.6, GLM-5.1, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.

GitHub

175K