AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-fxg7-897c-57mp: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

highvulnerability

security

Source: GitHub Advisory DatabaseSeptember 9, 2026CVE-2026-59158

Summary

Nuxt Ollama version 1.2.26 has a vulnerability where API keys for the Ollama service are accidentally placed in public runtime configuration (data that gets sent to web browsers). This means anyone can visit the website, look at the page source code, and steal the API key in plain text, then use it to make expensive API calls at the website owner's expense.

Solution / Mitigation

Move the `api_key` from public runtime config to private runtime config by separating it from other options during module setup. The `api_key` should only be used on the server side through `useRuntimeConfig().ollama.api_key` in server utilities, not sent to the browser. The source text provides a code diff showing how to split `api_key` from `publicOptions` and place it in `runtimeConfig.ollama` instead of `runtimeConfig.public.ollama`.