Skip to content
OpenAdvisories

Package · Go

github.com/ollama/ollama

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.6
    CVE-2025-44779

    Ollama allows deletion of arbitrary files

    An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.

    github.com/ollama/ollama Go
  • Medium 6.9
    CVE-2025-51471 Public exploit EPSS 19%

    Ollama vulnerable to Cross-Domain Token Exposure

    Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.

    k8sgpt mods ollama github.com/ollama/ollama Wolfi Go
  • Medium 6.6
    CVE-2024-28224

    Ollama DNS rebinding vulnerability

    Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

    github.com/ollama/ollama github.com/jmorganca/ollama Go