CVE-2025-63389: 
NixOS vulnerability analysis and mitigation

CVE-2025-63389 is a critical authentication bypass vulnerability in the Ollama platform's API endpoints, classified as "Missing Authentication for Critical Function" (CWE-306). It affects Ollama versions up to and including v0.12.3 (the GitHub Advisory Database notes affected versions as <= 0.13.5 with no patched version listed). The vulnerability was published on December 18, 2025, and discovered by Zhihuang Liu. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 score of 9.3 (Critical) (Github Advisory, Public Disclosure).

The root cause is CWE-306 (Missing Authentication for Critical Function) and CWE-284 (Improper Access Control): Ollama exposes multiple API endpoints that perform sensitive model management operations without enforcing any authentication or authorization checks. An unauthenticated remote attacker can send crafted HTTP requests directly to these exposed API endpoints over the network, requiring no prior credentials, special configuration, or user interaction. The attack vector is network-accessible (AV:N), with low complexity (AC:L) and no privileges required (PR:N), making exploitation straightforward for any attacker who can reach the Ollama service. A public disclosure gist was published by the researcher on January 21, 2026, referencing the vulnerability details (Github Advisory, Public Disclosure).

Successful exploitation allows remote, unauthenticated attackers to perform unauthorized model management operations against the Ollama platform, including enumerating installed AI models (information disclosure), manipulating or deleting existing models (integrity impact), injecting malicious model configurations (model poisoning), and potentially achieving remote code execution via malicious model configurations or prompt injection. The vulnerability poses high confidentiality and integrity risks, with the potential to fully compromise the Ollama platform's operational integrity and the trustworthiness of hosted AI models (Github Advisory, Public Disclosure).

1. Reconnaissance: Identify internet-facing Ollama instances using tools like Shodan or Censys by searching for the default Ollama port (11434) or known API response signatures. Confirm the version is <= v0.12.3.
2. Enumerate API endpoints: Send unauthenticated HTTP GET requests to known Ollama API endpoints such as /api/tags to list installed models without any credentials.
3. Perform unauthorized model management: Issue unauthenticated HTTP POST requests to endpoints such as /api/pull (to download arbitrary models), /api/delete (to remove models), or /api/copy (to duplicate models), bypassing any access control.
4. Inject malicious model: Use the /api/pull or /api/create endpoint to load a crafted or malicious model configuration onto the server, potentially enabling prompt injection or remote code execution via model execution pathways.
5. Achieve objective: Leverage unauthorized model access to exfiltrate sensitive model configurations, disrupt AI services by deleting models, or escalate further by exploiting model execution for code execution (Public Disclosure, Github Advisory).

• Network: Unexpected unauthenticated HTTP requests to Ollama API endpoints (e.g., /api/tags, /api/pull, /api/delete, /api/copy, /api/create) from external or unknown IP addresses; unusual outbound connections from the Ollama host to external model registries.
• Logs: Ollama access logs showing repeated API calls to model management endpoints without authentication headers from unfamiliar source IPs; bulk model pull or delete operations outside of normal operational hours.
• File System: Unexpected new model files appearing in the Ollama models directory; disappearance of previously installed models indicating unauthorized deletion.
• Process: Unusual child processes spawned by the Ollama service process; unexpected network connections initiated by the Ollama process to external hosts.

Organizations should upgrade Ollama to a version beyond v0.12.3 as soon as a patched release is available; the GitHub Advisory notes no patched version has been formally designated yet, so monitoring the Ollama releases page is recommended (Github Advisory). As immediate workarounds: restrict network access to the Ollama API port (default: 11434) using firewall rules or network segmentation so only trusted hosts can reach it; place the Ollama API behind a reverse proxy with authentication enforcement; and disable external API access entirely if the service does not need to be publicly accessible. Audit API access logs regularly for unauthorized model management activity.

The vulnerability was noted on Mastodon/infosec.exchange shortly after disclosure, and coverage appeared on security aggregation platforms including Vulners, VulDB, and CVEFeed within hours of publication (infosec.exchange). The INCIBE-CERT (Spain's national cybersecurity agency) published an early warning advisory for the vulnerability. Red Hat and SUSE also tracked the CVE in their vulnerability databases, indicating broad ecosystem awareness. No major vendor statements or high-profile researcher commentary beyond the original discoverer's disclosure have been identified.