CVE-2026-102697 in Ollama
Summary
by MITRE • 09/29/2026
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Ollama versions prior to 0.31.2 represents a critical failure in the authorization logic governing its experimental agent mode Bash tool execution mechanism. This flaw stems from an incorrect parsing of shell syntax within the command approval workflow, allowing for significant security implications when interacting with large language models that have access to system-level tools. The core issue lies in how the application validates and executes commands approved by users or automated policies. Instead of treating the entire string as a single atomic unit requiring explicit authorization, the underlying implementation fails to adequately sanitize or restrict control operators such as semicolons, logical ANDs, ORs, and other shell metacharacters that can chain multiple distinct commands together.
In operational terms, this vulnerability enables an attacker who has successfully injected malicious prompts into the model's context window to bypass session approval requirements. By crafting input that includes approved base commands followed by unauthorized control operators and subsequent arbitrary shell commands, the agent executes a sequence of actions where only the initial portion was explicitly permitted. For instance, if a user approves running ls, an attacker could inject text causing the system to execute ls; rm -rf / or similar destructive sequences. This effectively neutralizes the safety guardrails designed to prevent unauthorized file system modifications, data exfiltration, or privilege escalation through the bash tool interface. The attack vector relies heavily on prompt injection techniques, which exploit the model's tendency to follow instructions literally without sufficient semantic understanding of security boundaries in shell environments.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The failure occurs because the application does not properly isolate or validate special elements that alter command execution flow. Furthermore, within the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques involving Execution via User Interface and potentially Defense Evasion through Obfuscated Inputs. The attacker leverages the legitimate interface of the Ollama agent to execute arbitrary code on the host system, bypassing intended access controls. This is particularly dangerous in environments where Ollama runs with elevated privileges or has broad filesystem permissions, as it can lead to complete system compromise depending on the context and user rights under which the application operates.
The impact of this vulnerability extends beyond simple command execution. It undermines trust in automated agent workflows that rely on human-in-the-loop approval mechanisms for safety assurance. Organizations deploying Ollama agents for tasks such as log analysis, code generation with file access, or system administration scripts are at risk if they utilize the experimental bash tool without strict input validation and output filtering. The ability to chain commands allows attackers to perform reconnaissance, install backdoors, exfiltrate sensitive data, or disrupt services by executing destructive shell operations that were never explicitly approved in the initial prompt interaction.
Mitigation strategies must focus on both immediate patching and architectural hardening. Users should immediately upgrade Ollama to version 0.31.2 or later, where this parsing flaw has been addressed through improved command validation logic. In addition to upgrading, it is advisable to disable experimental agent modes in production environments unless absolutely necessary, as these features often introduce complex attack surfaces that are difficult to secure completely. When such tools must be used, implementing strict allow-listing of permitted commands and restricting the shell environment to a sandboxed container with minimal privileges can significantly reduce risk. Furthermore, applying input sanitization layers at the application level before passing strings to the model or after receiving output from it adds an essential defense-in-depth layer against prompt injection attacks that attempt to exploit parsing weaknesses in downstream tool execution mechanisms.