HN Explorer

Ollama token exfiltration still present in latest release

1 points by ajtazer ↗ HN
I reproduced CVE-2025-51471 on the latest Ollama release and confirmed the issue is still present with the proposed fix unmerged.

Short demo video showing the token exfiltration flow: https://youtu.be/kC80FSrWbNk

Original disclosure (FuzzingLabs / Huntr): https://huntr.com/bounties/94eea285-fd65-4e01-a035-f533575ebdc2

Fix PR (still open at time of testing): https://github.com/ollama/ollama/pull/10750

2 comments

[ 3.1 ms ] story [ 15.8 ms ] thread
ajtazer
The issue is a trust boundary failure in the registry authentication flow: the client accepts the WWW-Authenticate realm provided by a registry without validating origin, which allows signed authentication material to be sent to an attacker-controlled endpoint during a normal model pull.

No exploit chain or malware is involved. The client generates and forwards the token itself based on untrusted input.

The original disclosure credits FuzzingLabs. I focused on reproducing the issue on current builds and validating the impact.