high · 7.5CVE-2026-59158Sep 10, 2026

CVE-2026-59158: nuxt-ollama API Key Exposed in SSR HTML Payload

Shubham Kandhare
Security Engagement Manager, SecureLayer7

nuxt-ollama placed the Ollama cloud API key inside Nuxt's public runtime config, causing it to appear in plaintext inside every server-rendered HTML page, readable by anyone with a browser or curl.

Packagenuxt-ollama
Ecosystemnpm
Affected>= 1.2.26, < 1.3.1
Fixed in1.3.1
CVE-2026-59158: nuxt-ollama API Key Exposed in SSR HTML Payload

The problem

In versions 1.2.26 through 1.3.0, src/module.ts merged the entire module options object, including api_key, into runtimeConfig.public.ollama. Nuxt serializes that namespace into the window.__NUXT__ script block embedded in every SSR response.

Any unauthenticated HTTP client, crawler, or passive observer that fetches the home page receives the API key in plaintext. No login, no special headers, no prior knowledge of the app is needed.

Proof of concept

A working proof-of-concept for CVE-2026-59158 in nuxt-ollama, with the exact payload below.

bash
curl -s http://<target>/ | grep -o 'api_key":"[^"]*"'
# Returns: api_key":"<YOUR_REAL_KEY>"

The root cause is src/module.ts:36: runtimeConfig.public.ollama = defu(currentConfig, _options). Because _options contains api_key, the key lands in the public namespace that Nuxt bakes into the HTML payload for client-side hydration.

The patch (1.3.1) destructures api_key out of _options before the merge, routes it into runtimeConfig.ollama (the private namespace, server-only), and removes it from the browser composable. Only the server-side utility reads it from there. The browser composable never sees the key at all.

This is CWE-522: Insufficiently Protected Credentials.

The fix

Upgrade to nuxt-ollama 1.3.1. The fix moves api_key to runtimeConfig.ollama (private, server-only) and strips it from the public config that is serialized into the HTML payload. No other configuration change is required on the operator side.

Reporter not attributed.

References: [1][2]

Related research