ollama - 💡(How to fix) Fix Gin DebugMode is the default — error stack traces leak internal paths to API clients

CWE-209: Gin DebugMode Default — Information Leakage via Stack Traces

Severity: MEDIUM (CVSS 5.3)

Location

server/routes.go:

var mode string = gin.DebugMode

Description

Ollama's HTTP server defaults to Gin's DebugMode. In debug mode, Gin returns detailed error pages containing:

• Full stack traces with file paths and line numbers
• Internal server paths (e.g., /home/user/.ollama/...)
• Framework internals

Every panic or unhandled error leaks implementation details to any client making requests. There is no environment variable to switch to ReleaseMode — the mode variable is hardcoded.

Impact

An attacker probing the API can:

• Map internal filesystem paths
• Identify Go version and Gin framework version from stack traces
• Discover internal package structure
• Use leaked paths for further path traversal or configuration file access

Remediation

// Set mode based on environment
if os.Getenv("OLLAMA_DEBUG") == "" {
    mode = gin.ReleaseMode
}
// Or at minimum, make it configurable:
if v := os.Getenv("OLLAMA_GIN_MODE"); v != "" {
    mode = v
}