CVE-2026-59158

Nuxt Ollama exposes configured cloud API keys in browser-visible configuration

thoda-dev · nuxt-ollama

First documented disclosure · Review checkpoint

Summary

A page response can reveal the configured Ollama cloud API key to an anonymous visitor.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

All module options are merged into public runtime configuration, which Nuxt serializes into server-rendered HTML.

Conditions required

An application uses the affected module with a cloud api_key configured; fetching a page is sufficient even without a visible model call.

Potential impact

Unauthorized cloud API usage and quota costs; stored data is exposed only if the key grants corresponding access.

Affected versions and configurations

nuxt-ollama <1.3.1.

Fix and mitigation status

1.3.1.

Practical next steps

Upgrade, move secrets behind server-only access and rotate exposed cloud keys. Check cached HTML and deployed bundles.

Operating lesson

Anything in public runtime configuration must be safe for every visitor to read.

Evidence and limits

The maintainer advisory and explicit security release were public June 20; October 27 is CVE publication. The reproduction used a sentinel key and does not establish real key theft.

Sources