CVE-2026-59158 Details
Description
Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.
A vulnerability in the Nuxt Ollama integration prior to version 1.3.1 allows for the exposure of the Ollama cloud API key through the public runtime configuration. The issue arises because the module unconditionally merges all options, including the API key, into a public config that is serialized and sent to the client. This leak occurs in the server-rendered HTML, where the API key can be extracted by any unauthenticated user. The exposed key can then be used for unauthorized API requests, potentially leading to abuse of the API quota or access to sensitive data, such as stored models or conversations, depending on the permissions granted by the key.
Users can update to Nuxt Ollama version 1.3.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thoda-dev/nuxt-ollama/security/advisories/GHSA-fxg7-897c-57mp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/thoda-dev/nuxt-ollama/commit/156e813783ef322ee10dbbdd6bf446a449e1a04f | [email protected] | Source CodeVendor |
| https://github.com/thoda-dev/nuxt-ollama/releases/tag/v1.3.1 | [email protected] | Release NotesVendor |
| https://github.com/thoda-dev/nuxt-ollama/security/advisories/GHSA-fxg7-897c-57mp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| thoda-dev nuxt-ollama | 1.2.26 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |