Vulnerability · Published Sep 29, 2026 · Assigned by VulnCheck

CVE-2026-102697Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization

High 7.8

In plain English

A high-severity incorrect authorization in ollama from ollama. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.1%top 96.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.

Affected products (as reported)

Vendor	Product	Versions
ollama	ollama	0.14.0 – before 0.31.2

Weakness: CWE-863 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Patch Commit patch
ollama v0.31.2 Release Notes release-notes
https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L204-L206 technical-description
https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L389 technical-description
https://github.com/ollama/ollama product
VulnCheck Advisory: Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization third-party-advisory