Public API Key Exposure in Nuxt Ollama by Thoda Dev

CVE-2026-59158

What is CVE-2026-59158?

The Nuxt Ollama integration allows the merging of sensitive module options, including the cloud API key, into a public configuration that is exposed in the server-rendered HTML. This configuration is serialized into the window.__NUXT__ payload, making the API key accessible in plaintext to any unauthenticated client. Furthermore, this key can be misused in browser-side requests as an Authorization Bearer credential, leading to unauthorized cloud API calls, potential exhaustion of quotas, and access to sensitive models or stored conversations. The vulnerability was addressed in version 1.3.1.

References