CVE-2026-59158 is a vulnerability in nuxt-ollama versions prior to 1.3.1 where an API key configured for cloud access is exposed in the client-side HTML payload. This exposure occurs because the module options, including the cloud api_key, are merged into a public runtime configuration that Nuxt serializes into the server-rendered HTML. As a result, unauthenticated clients can retrieve the API key in plaintext, enabling unauthorized use of the cloud API. The issue is fixed in version 1.3.1.