Is CVE-2025-51471 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-51471 being exploited in the wild.

How severe is CVE-2025-51471?

Medium severity, with a CVSS score of 6.9, published 22 July 2025.

Which products and versions are affected?

github.com/ollama/ollama (Go) <= 0.9.6, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.9.6; Ollama <= 0.9.6; ollama (PyPI) ECOSYSTEM:introduced=0,last_affected=0.6.7-NA.

Is there a fix for CVE-2025-51471?

A patch was published on 2025-05-16: Fix submitted via Pull Request #10750 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-51471 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-51471?

Check whether you run github.com/ollama/ollama (Go), Ollama or ollama (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-51471: Ollama Cross-Domain Token Exposure in model pull mechanism

Q: Is there a fix for CVE-2025-51471?

A patch was published on 2025-05-16: Fix submitted via Pull Request #10750 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-51471 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-51471?

Check whether you run github.com/ollama/ollama (Go), Ollama or ollama (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-51471 · Severity: medium · CVSS 6.9 · Published 2025-07-22

Ollama, a tool for running large language models, is vulnerable to a flaw that could allow an attacker to steal a user's authentication tokens. By tricking a user into pulling a model from a malicious server, the attacker can redirect the authentication process to their own domain. This could lead to unauthorized access to private models or the ability to upload malicious models under the victim's identity.

Technologies: github.com/ollama/ollama (Go), Ollama, ollama (PyPI). Vendors: Go, Ollama, PyPI.

Quick answers

Is CVE-2025-51471 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-51471 being exploited in the wild.
How severe is CVE-2025-51471?: Medium severity, with a CVSS score of 6.9, published 22 July 2025.
Which products and versions are affected?: github.com/ollama/ollama (Go) <= 0.9.6, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.9.6; Ollama <= 0.9.6; ollama (PyPI) ECOSYSTEM:introduced=0,last_affected=0.6.7-NA.
Is there a fix for CVE-2025-51471?: A patch was published on 2025-05-16: Fix submitted via Pull Request #10750 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-51471 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-51471?: Check whether you run github.com/ollama/ollama (Go), Ollama or ollama (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the `server.auth.getAuthorizationToken` function within Ollama's model pulling mechanism. When the `/api/pull` endpoint interacts with a remote server that returns a 401 Unauthorized status, Ollama follows the URL provided in the `WWW-Authenticate` header's realm parameter without verifying if it matches the original request's domain. A remote attacker can host a malicious registry and provide a realm URL pointing to a legitimate service (like registry.ollama.ai), causing Ollama to send the user's valid authentication tokens to the attacker-controlled server. This allows for session hijacking and unauthorized access to private registry resources.

Affected products

Ollama Ollama <= 0.9.6

Identifiers

CVE-2025-51471
GHSA-x9hg-5q6g-q3jr
GO-2025-3824
PYSEC-2025-147

Timeline

2024-12-24: disclosed: Original finding by FuzzingLabs reported via Huntr
2025-05-16: patched: Fix submitted via Pull Request #10750
2025-07-22: advisory: GitHub Advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.