# CVE-2025-51471: Ollama Cross-Domain Token Exposure in model pull mechanism

Source: https://junglewise.ai/threats/cve-2025-51471-ollama-cross-domain-token-exposure-in-model-pull-mechanism  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-22. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2025-51471 · Severity: medium · CVSS 6.9 · Published 2025-07-22

Ollama, a tool for running large language models, is vulnerable to a flaw that could allow an attacker to steal a user's authentication tokens. By tricking a user into pulling a model from a malicious server, the attacker can redirect the authentication process to their own domain. This could lead to unauthorized access to private models or the ability to upload malicious models under the victim's identity.

Technologies: [github.com/ollama/ollama (Go)](https://junglewise.ai/threats/technologies/github-com-ollama-ollama), [Ollama](https://junglewise.ai/threats/technologies/ollama), [ollama (PyPI)](https://junglewise.ai/threats/technologies/pypi-ollama). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Ollama](https://junglewise.ai/threats/vendors/ollama), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-51471 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-51471 being exploited in the wild.

**How severe is CVE-2025-51471?** Medium severity, with a CVSS score of 6.9, published 22 July 2025.

**Which products and versions are affected?** github.com/ollama/ollama (Go) <= 0.9.6, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.9.6; Ollama <= 0.9.6; ollama (PyPI) ECOSYSTEM:introduced=0,last_affected=0.6.7-NA.

**Is there a fix for CVE-2025-51471?** A patch was published on 2025-05-16: Fix submitted via Pull Request #10750 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-51471 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-51471?** Check whether you run github.com/ollama/ollama (Go), Ollama or ollama (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the `server.auth.getAuthorizationToken` function within Ollama's model pulling mechanism. When the `/api/pull` endpoint interacts with a remote server that returns a 401 Unauthorized status, Ollama follows the URL provided in the `WWW-Authenticate` header's realm parameter without verifying if it matches the original request's domain. A remote attacker can host a malicious registry and provide a realm URL pointing to a legitimate service (like registry.ollama.ai), causing Ollama to send the user's valid authentication tokens to the attacker-controlled server. This allows for session hijacking and unauthorized access to private registry resources.

## Affected products

- Ollama Ollama <= 0.9.6

## Identifiers

- CVE-2025-51471
- GHSA-x9hg-5q6g-q3jr
- GO-2025-3824
- PYSEC-2025-147

## Timeline

- 2024-12-24: disclosed: Original finding by FuzzingLabs reported via Huntr
- 2025-05-16: patched: Fix submitted via Pull Request #10750
- 2025-07-22: advisory: GitHub Advisory and CVE published

## References

- [https://github.com/ollama/ollama/pull/10750](https://github.com/ollama/ollama/pull/10750)
- [https://github.com/ollama/ollama](https://github.com/ollama/ollama)
- [https://www.gecko.security/blog/cve-2025-51471](https://www.gecko.security/blog/cve-2025-51471)
- [https://huntr.com/bounties/94eea285-fd65-4e01-a035-f533575ebdc2](https://huntr.com/bounties/94eea285-fd65-4e01-a035-f533575ebdc2)
- [https://github.com/pypa/advisory-database/tree/main/vulns/ollama/PYSEC-2025-147.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/ollama/PYSEC-2025-147.yaml)

## Related threats

- [Ollama server-side request forgery in Pull API](https://junglewise.ai/threats/cve-2026-108836-a-vulnerability-has-been-found-in-ollama-up-to-0-34-1-the)
- [Ollama authorization bypass in experimental agent Bash tool approval](https://junglewise.ai/threats/cve-2026-102697-ollama-versions-0-14-0-before-0-31-2-contain-an-incorrect)
- [Ollama integer overflow in GGUF decoder](https://junglewise.ai/threats/cve-2026-86289-ollama-integer-overflow-in-gguf-decoder)
- [Ollama unvalidated redirect in model blob downloads](https://junglewise.ai/threats/cve-2026-85180-ollama-unvalidated-redirect-in-model-blob-downloads)
- [Ollama uncontrolled memory allocation in GGUF metadata parser](https://junglewise.ai/threats/cve-2026-65315-ollama-uncontrolled-memory-allocation-in-gguf-metadata-parser)