CVE-2026-59158
CVE-2026-59158 · Nuxt Ollama: public runtime configuration discloses the configured cloud API key
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.
CVSS 7.5 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
nuxt-ollama
- Versions
- < 1.3.1: Affected
No fix published
nuxt-ollama npm
- Affected ranges
- SEMVER: ≥ 1.2.26, < 1.3.1
Update to 1.3.1