CVE-2025-63389
Published: 18 December 2025
Summary
CVE-2025-63389 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Ollama Ollama. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 34.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-14 explicitly limits actions permitted without identification or authentication, directly preventing unauthorized model management operations on exposed Ollama API endpoints.
IA-9 requires identification and authentication mechanisms for provided services, addressing the complete lack of authentication on Ollama's vulnerable API endpoints.
AC-3 enforces approved authorizations for access to system resources, mitigating unauthorized remote operations such as model listing, pulling, and deletion via unauthenticated APIs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authentication bypass in Ollama API endpoints enables exploitation of public-facing application (T1190), privilege escalation (T1068), model enumeration (T1083, T1518), model deletion (T1070.004), stored data manipulation via model poisoning (T1565.001), and staging malicious models (T1608.001).
NVD Description
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.
Deeper analysisAI
CVE-2025-63389 is a critical authentication bypass vulnerability (CWE-306) in the Ollama platform's API endpoints, affecting versions prior to and including v0.12.3. Ollama, an open-source tool for running large language models locally, exposes multiple API endpoints without requiring authentication, allowing remote attackers to perform unauthorized model management operations. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility and lack of privileges needed for exploitation.
Remote attackers can exploit this vulnerability over the network without authentication by directly accessing the unprotected API endpoints. Successful exploitation enables unauthorized operations such as listing, pulling, deleting, or managing models on the target Ollama instance, potentially leading to full compromise of confidentiality, integrity, and availability of the platform's resources.
Mitigation details and further advisories are available in the following references: https://gist.github.com/Cristliu/48dae561696374744d9fced07a544ecd, https://gist.github.com/Cristliu/b6f4d070fb27932f581be1aadc0923e7, and https://github.com/ollama/ollama/issues. Security practitioners should review these for patch information and upgrade recommendations.
Ollama's role in facilitating local deployment of AI/ML models underscores the relevance of this vulnerability to environments handling sensitive inference workloads. No public information on real-world exploitation is available as of the CVE publication on 2025-12-18.
Details
- CWE(s)