-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Reliance on DNS-based validation (CWE-350) for security decisions, and 2) Lack of proper authentication (CWE-290). While exact function names aren't available, the nature of DNS rebinding vulnerabilities typically involves HTTP request handlers that: - Trust the Host header without validation - Fail to implement proper CORS restrictions - Lack CSRF protections The high confidence comes from the vulnerability pattern matching typical DNS rebinding attack vectors in web services, where API endpoints are exposed without proper origin validation. The NCC Group advisory confirms attackers could access the full API surface, indicating missing authorization checks in core request handling functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/ollama/ollama | go | < 0.1.29 | 0.1.29 |
Ongoing coverage of React2Shell