CVE-2026-102697CWE-863broken-access-control

CVE-2026-102697

High · published September 29, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.5 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00146 · 3.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-29T21:17Z
References (6)
https://github.com/ollama/ollama · [email protected]https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L204-L206 · [email protected]https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L389 · [email protected]https://github.com/ollama/ollama/commit/a2b3a5e9a3956bc0700a8505580c11faf4da09b5 · [email protected]https://github.com/ollama/ollama/releases/tag/v0.31.2 · [email protected]https://www.vulncheck.com/advisories/ollama-0.14.0-before-0.31.2-experimental-agent-bash-approval-bypass-via-prefix-based-authorization · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 16:46Z
    Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
    cvelistv5