Ollama Platform Authentication Bypass Vulnerability in API Endpoints

A critical authentication bypass vulnerability has been identified in the Ollama platform's API endpoints, affecting versions prior to and including v0.12.3. This vulnerability allows remote attackers to access multiple API endpoints without authentication, enabling unauthorized model management operations. The vulnerable endpoints include '/api/tags', '/v1/models', '/api/copy', '/api/delete', '/api/create', '/api/generate', and '/api/chat'.

Impact

Exploitation of this vulnerability could lead to unauthorized access and management of models, allowing for model poisoning through the injection of malicious prompts. Additionally, there is a potential for remote code execution via compromised model configurations.