CVE-2026-102697
Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
ollama ollama
CVSS
8.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.31.2ollamaCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.
Text from CVE List
Affected versions 1
- ollamaaffected: 0.14.0 before 0.31.2CVE List
References 6
- github.com/ollama/ollama/commit/a2b3a5e9a3956bc0700a8505580c11faf4da09b5Fixvia CVE List
- github.com/ollama/ollama/releases/tag/v0.31.2Fixvia CVE List
- vulncheck.com/advisories/ollama-0.14.0-before-0.31.2-experimental-agent-bash-approval-bypass-via-prefix-based-authorizationAdvisoryvia CVE List
- github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L204-L206Referencevia CVE List
- github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L389Referencevia CVE List
- github.com/ollama/ollamaReferencevia CVE List