What’s Vulnerable › Vulnerabilities

CVE-2026-102697: Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-29 · updated 2026-09-29
• Weakness: CWE-863

Description

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.

Affected products

• Ollama: from 0.14.0 before 0.31.2 — fixed in 0.31.2

How to fix

Upgrade to a fixed version: Ollama 0.31.2. Check the vendor advisory for mitigations.

References

• https://github.com/ollama/ollama
• https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L204-L206
• https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L389
• https://github.com/ollama/ollama/commit/a2b3a5e9a3956bc0700a8505580c11faf4da09b5
• https://github.com/ollama/ollama/releases/tag/v0.31.2
• https://www.vulncheck.com/advisories/ollama-0.14.0-before-0.31.2-experimental-agent-bash-approval-bypass-via-prefix-based-authorization

Get alerted when CVE-2026-102697 or the next vulnerability affects your stack