CVE-2026-59158

Received Received - Intake

Exposure of API Key in Nuxt Ollama Module

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-59158

Affected Vendors & Products

Vendor	Product	Version / Range
thoda-dev	nuxt-ollama	< 1.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

Nuxt Ollama before 1.3.1 exposes API keys in server-rendered HTML. The module merges cloud API keys into public runtime config, which Nuxt serializes into the window.__NUXT__ payload. This leaks the key to any client fetching the page, even without making an Ollama request.

Detection Guidance

Check if your Nuxt application using Nuxt Ollama version is below 1.3.1. Inspect server-rendered HTML for `window.__NUXT__` payload to see if API keys are exposed in plaintext. Review network requests for `Authorization: Bearer` headers containing API keys.

Impact Analysis

An attacker can steal the API key and make unauthorized cloud API requests at your expense. This may lead to quota exhaustion, rate limiting, or access to stored models or conversations if the key has those permissions.

Mitigation Strategies

Upgrade Nuxt Ollama to version 1.3.1 or later. Remove any cloud API keys from the public configuration and use server-side environment variables instead. Audit and rotate any exposed API keys immediately.

Hi! I’m here to help you understand CVE-2026-59158. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70