CVE-2025-51471
Medium · 6.9Ollama vulnerable to Cross-Domain Token Exposure
CVSS
6.9
EPSS
13.9%
Published
Jul 22, 2025
CISA due date
—
The record
Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/ollama/ollama | 0 | No fix |
| Chainguard | k8sgpt | 0 | 0.4.28-r0 |
| Chainguard | ollama | 0 | 0.12.10-r0 |
| Chainguard | ollama-cpu | 0 | 0.12.10-r0 |
| Chainguard | ollama-fips | 0 | 0.12.10-r0 |
| Wolfi | k8sgpt | 0 | 0.4.28-r0 |
| Wolfi | ollama | 0 | 0.12.10-r0 |
| Wolfi | ollama-cpu | 0 | 0.12.10-r0 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0 | 0.0.20250730T213748-1.1 |
Related vulnerabilities
- CVE-2025-63389 Ollama Platform has missing authentication enabling attackers to perform model management… Also affects github.com/ollama/ollama
- CVE-2025-0317 Ollama Divide By Zero vulnerability Also affects github.com/ollama/ollama
- CVE-2024-37032 Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex… Also affects github.com/ollama/ollama
- CVE-2026-32285 The Delete function fails to properly validate offsets when processing malformed JSON… Also affects k8sgpt
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects k8sgpt
- CVE-2025-68476 KEDA is a Kubernetes-based Event Driven Autoscaling component. Also affects k8sgpt
- CVE-2024-35255 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege… Also affects k8sgpt
- CVE-2026-33809 A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB… Also affects ollama