plaincve:~$

// threat brief

CVE-2026-102697

Ollama experimental agent mode Bash approval bypass: only the start of a command is checked, so commands chained after it also get through

CVSS
8.5 HIGH
CISA KEV
Not listed
Weakness
CWE-863
Topics
AI security

PlainCVE Team · Published 2026-10-07 · AI-assisted · Press brief ↓

AI review 2026-10-07 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

Ollama's experimental agent mode approves Bash commands by prefix only, so prompt injection can tack unapproved commands onto an approved one.

Who is affectedPeople running Ollama 0.14.0 up to (not including) 0.31.2 who have turned on the experimental agent mode with --experimental and let the model use its Bash tool.
What happensIf an attacker can influence the model's output through prompt injection, they can run extra shell commands on your machine that you never approved, bypassing the step where you must approve commands.
What to do nowUpgrade to 0.31.2: the CVE record from the CNA (VulnCheck) puts the upper bound of the affected range at 0.31.2, and the patch commit the CNA lists is included in v0.31.2. However, as of 2026-10-07 Ollama's GitHub security advisories page lists no published advisories, and its release notes don't mention the fix. Until Ollama confirms it, PlainCVE suggests not using the --experimental agent mode.
Affected versions0.14.0 up to, but not including, 0.31.2
Fixed versions0.31.2 (the CNA VulnCheck's CVE record gives 0.31.2 as the upper bound of the affected range, and the listed patch commit a2b3a5e is in the v0.31.2 tag; as of 2026-10-07, Ollama's GitHub security advisories page lists no published advisories)
CVSS vector
Show full vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Timeline
  • First public 2026-07-02

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check your version and whether you use experimental agent mode

    You are in scope only if both hold: your version is 0.14.0 up to (not including) 0.31.2, and you have used --experimental to turn on agent mode and let the model use the Bash tool.

    Read-only check
    ollama --version
    Step 2
  2. 02No published detection method

    None of the sources gives detection guidance, and none contains a security advisory from Ollama for this CVE. CISA's SSVC recorded no known exploitation as of 2026-09-29.

MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Upgrade to 0.31.2

    The CVE record from the CNA (VulnCheck) gives the affected range as before 0.31.2, and according to GitHub's git history the listed patch commit a2b3a5e is in v0.31.2 and not in v0.31.1. As of 2026-10-07, Ollama's GitHub security advisories page lists no published advisories, and its release notes don't mention this fix.

    Read-only check
    ollama --version
    Step 3
  2. 02Until the fix is confirmed, don't use the --experimental agent mode

    Agent mode is opt-in (in the v0.31.1 source, the --experimental flag of ollama run defaults to off). If you don't turn it on, the flawed approval code isn't reached. This is our analysis, not vendor guidance.

    Step 2
RESPONDRespondIf you find signs of compromise
  1. 01If you suspect exploitation, treat the machine as possibly compromised

    The sources give no incident response guidance. Because SSVC rates the technical impact as 'total', PlainCVE suggests reviewing which commands the agent ran and rotating passwords and keys reachable from that machine. This is a precaution, not a confirmation that anything leaked.

    Step 4
HARDENHardenPrevent the next one
  1. 01Don't let agents with shell access read untrusted content

    This bug requires the attacker to influence model output through prompt injection. PlainCVE suggests keeping agents that have the Bash tool away from data of unknown origin.

    Step 1
  2. 02Don't rely only on auto-allow lists

    Prefix-only allowlists are easy to bypass by chaining commands. PlainCVE suggests running agents in an isolated environment and confirming each command.

    Step 3Step 4
Full remediation steps and notes
  1. Check your version. Run ollama --version. Anything from 0.14.0 up to (not including) 0.31.2 is in scope.
  2. Upgrade to 0.31.2 or later. The CVE record from the CNA (VulnCheck) gives the affected range as before 0.31.2 and lists a patch commit (a2b3a5e, 2026-07-02, titled “agent: harness core (#16963)”) and the v0.31.2 release notes. According to GitHub’s git history (comparison), that commit is included in the v0.31.2 tag (which points to a6293eb) and is not in v0.31.1. However, as of 2026-10-07, Ollama’s GitHub security advisories page lists no published advisories, and the 0.31.2 release notes don’t mention this fix. The commit changes x/agent/approval.go but isn’t described as a security fix, and the primary data doesn’t show whether it actually corrects the approval logic. OSV lists both a6293eb and a2b3a5e as fixes.
  3. Until that is confirmed. The vendor gives no workaround. Our analysis: agent mode is opt-in, so if you don’t use --experimental, this code isn’t reached.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

Ollama experimental agent mode Bash approval bypass: only the start of a command is checked, so commands chained after it also get through: 1. The attacker uses prompt injection to influence the model's output → 2. The user runs the experimental agent mode and the model proposes a Bash command → 3. The approval check only matches the start of the command and doesn't parse shell syntax → 4. The unapproved extra commands run on the local machineCVE-2026-102697 · Ollama experimental agent mode Bash approval bypass: only the start ofa command is checked, so commands chained after it also get throughAttackerYour systemThe attacker uses prompt injection to influence the model's output — No account or privileges are needed (CVSS rates it PR:N), but the attacker must be able to steer what the model says and which commands it proposes, through prompt injection. 1The attacker usesprompt injectionto influence themodel's outputThe user runs the experimental agent mode and the model proposes a Bash command — Agent mode is opt-in and turned on with ollama run --experimental. The proposed command starts with an already approved command, with semicolons or logical operators and extra commands appended. 2The user runs theexperimental agentmode and the modelproposes a Bas…The approval check only matches the start of the command and doesn't parse shell syntax — The Bash tool keeps a list of command prefixes that are always allowed. Because shell syntax isn't parsed properly, the whole string is treated as the approved command and the user isn't asked. 3The approval checkonly matches thestart of thecommand an…The unapproved extra commands run on the local machine — CVSS rates the impact on confidentiality, integrity and availability all as High; CISA's SSVC assessment rates the technical impact as 'total'. 4The unapprovedextra commands runon the localmachineAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-102697-ollama-agent-bash-approval-bypass · CC BY 4.0
Ollama experimental agent mode Bash approval bypass: only the start of a command is checked, so commands chained after it also get through: 1. The attacker uses prompt injection to influence the model's output → 2. The user runs the experimental agent mode and the model proposes a Bash command → 3. The approval check only matches the start of the command and doesn't parse shell syntax → 4. The unapproved extra commands run on the local machineCVE-2026-102697 · Ollama experimentalagent mode Bash approval bypass: onlythe start of a command is checked, socommands chained after it also ge…The attacker uses prompt injection to influence the model's output — No account or privileges are needed (CVSS rates it PR:N), but the attacker must be able to steer what the model says and which commands it proposes, through prompt injection. 1AttackerThe attacker uses promptinjection to influence themodel's outputThe user runs the experimental agent mode and the model proposes a Bash command — Agent mode is opt-in and turned on with ollama run --experimental. The proposed command starts with an already approved command, with semicolons or logical operators and extra commands appended. 2Your systemThe user runs the experimentalagent mode and the modelproposes a Bash commandThe approval check only matches the start of the command and doesn't parse shell syntax — The Bash tool keeps a list of command prefixes that are always allowed. Because shell syntax isn't parsed properly, the whole string is treated as the approved command and the user isn't asked. 3Your systemThe approval check only matchesthe start of the command anddoesn't parse shell syntaxThe unapproved extra commands run on the local machine — CVSS rates the impact on confidentiality, integrity and availability all as High; CISA's SSVC assessment rates the technical impact as 'total'. 4Your systemThe unapproved extra commandsrun on the local machineAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-102697-ollama-agent-bash-approval-bypass
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    The attacker uses prompt injection to influence the model's output

    No account or privileges are needed (CVSS rates it PR:N), but the attacker must be able to steer what the model says and which commands it proposes, through prompt injection.

    Defense: PlainCVE suggestion: don't let an agent with the Bash tool enabled process content from untrusted sources.

  2. Your system

    The user runs the experimental agent mode and the model proposes a Bash command

    Agent mode is opt-in and turned on with ollama run --experimental. The proposed command starts with an already approved command, with semicolons or logical operators and extra commands appended.

    Defense: Our analysis: if you don't use the --experimental agent mode, this code path is not reached.

  3. Your system

    The approval check only matches the start of the command and doesn't parse shell syntax

    The Bash tool keeps a list of command prefixes that are always allowed. Because shell syntax isn't parsed properly, the whole string is treated as the approved command and the user isn't asked.

    Defense: Upgrade to 0.31.2 (the upper bound of the affected range in the CNA's CVE record, and it includes the patch commit the CNA lists; as of 2026-10-07, Ollama's GitHub security advisories page lists no published advisories).

  4. Your system

    The unapproved extra commands run on the local machine

    CVSS rates the impact on confidentiality, integrity and availability all as High; CISA's SSVC assessment rates the technical impact as 'total'.

Who is affected

ConditionAffected?
Ollama 0.14.0 up to, but not including, 0.31.2 + agent mode turned on with --experimental and the Bash tool in useAffected
Ollama 0.31.2 or laterNot listed as affected in the CNA’s CVE record; the patch commit the CNA lists is in v0.31.2; as of 2026-10-07, Ollama’s GitHub security advisories page lists no published advisories
Before the 0.14.0 final releaseOutside the CNA’s affected range (semver, from 0.14.0). But Phoronix reports that agent mode was already added in 0.14.0-rc2 (2026-01-10); whether rc versions are affected can’t be confirmed
Only chatting with models in Ollama, agent mode never turned onOur analysis: the flawed code isn’t reached

The attacker also has to be able to influence the model’s output through prompt injection (hiding instructions in content the model reads). The CNA’s CVSS rates the attack vector as Local, with user interaction required (UI:R in CVSS 3.1, UI:P, passive, in CVSS 4.0) and no privileges needed.

How it works

Starting with 0.14 (0.14-rc2, January 2026), Ollama has an experimental agent mode. The model can use a Bash tool to run commands on your computer, but you have to approve them first. So that you aren’t asked every time, the code keeps a list of command prefixes that are always allowed (x/agent/approval.go at v0.31.1), and approval is decided by looking at how a command starts.

The problem is that this approval check doesn’t parse shell syntax properly. If the model proposes a command that starts with an approved one and then uses a semicolon or a logical operator (shell control operators, which join several commands together) to add other commands, the whole string is treated as the approved command. The extra commands run without asking. This is CWE-863 (incorrect authorization).

The attacker needs to steer, through prompt injection, which commands the model proposes; CVSS rates the attack vector as Local with user interaction required.

The flawed approach (conceptual illustration, not the original source code):

Show code example(go)
// If the command starts with an allowed prefix, let the whole string through
for _, p := range autoAllowPrefixes {
    if strings.HasPrefix(cmd, p) {
        return Allowed
    }
}

A safer approach (general illustration; the sources don’t show the actual fix):

Show code example(go)
// Break the command down by shell syntax first; if it contains
// control operators or multiple commands, don't auto-allow it, ask the user
if containsShellControlOperators(cmd) {
    return AskUser
}

Timeline

DateEvent
2026-01Ollama 0.14-rc2 adds the experimental agent and Bash tool, including a prefix-based allowlist
2026-07-02Public date given in the CVE record
2026-07-06 or 07-070.31.2 released; the release page shows 6 July, but the rc2 tag on the same commit shows 7 July. The sources disagree
2026-09-29CVE reserved and published (CNA: VulnCheck); CISA SSVC records no known exploitation
2026-10-01Not listed in CISA KEV

Further reading

  • Scoring differences: the CNA gives two scores, 8.5 in CVSS 4.0 and 7.8 in CVSS 3.1. They differ only because they use different CVSS versions. As of the snapshot, NVD had the CVE as “Awaiting Analysis”.
  • CISA’s SSVC assessment: exploitation “none”, not automatable, technical impact “total”. GitHub shows an EPSS probability of 0.00146 (percentile 0.03278).
  • There is no evidence either way on whether it was exploited before a fix existed. The CVE record’s public date (2 July) is earlier than the 0.31.2 release (6–7 July). We think the issue may have been public before a fixed release existed, but this is not confirmed.
  • GitHub Advisory Database ID: GHSA-44m8-pr79-3734, not yet reviewed by GitHub. OSV lists 02a24015968d612b418448b73cffaa1b0652d161 as the commit that introduced the bug.
  • None of the sources we reviewed contains a security advisory from Ollama for this CVE, and no source gives detection guidance.
  • Credited finder: Akıner Kısa (per VulnCheck’s advisory).
  • Related weakness type: CWE-863.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-07 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. CVE / NVD / OSVCVE-2026-102697 CVE record (CVE Services API) · CVE Program / VulnCheck (CNA), 2026-09-29 · accessed 2026-10-01
  2. AdvisoryOllama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization · VulnCheck · accessed 2026-10-01
  3. CVE / NVD / OSVNVD API - CVE-2026-102697 · NIST · accessed 2026-10-01
  4. AdvisoryGitHub Advisory Database - GHSA-44m8-pr79-3734 (unreviewed) · GitHub · accessed 2026-10-01
  5. OtherOSV - CVE-2026-102697 · OSV · accessed 2026-10-01
  6. Patch / releaseagent: harness core (#16963), commit a2b3a5e · Ollama (GitHub) · accessed 2026-10-01
  7. Patch / releaseGitHub compare: v0.31.2...a2b3a5e (a2b3a5e is included in v0.31.2) · Ollama (GitHub) · accessed 2026-10-06
  8. Patch / releaseGitHub compare: v0.31.1...a2b3a5e (a2b3a5e is not in v0.31.1) · Ollama (GitHub) · accessed 2026-10-06
  9. Vendorcmd/cmd.go at v0.31.1 (--experimental flag defaults to off) · Ollama (GitHub) · accessed 2026-10-06
  10. Vendorx/agent/approval.go at v0.31.1 · Ollama (GitHub) · accessed 2026-10-01
  11. VendorOllama v0.31.2 release · Ollama (GitHub) · accessed 2026-10-01
  12. VendorOllama v0.31.2-rc2 release · Ollama (GitHub) · accessed 2026-10-01
  13. VendorOllama GitHub security advisories page (no published advisories as of 2026-10-07) · Ollama (GitHub) · accessed 2026-10-07
  14. NewsOllama 0.14-rc2 adds experimental agent loop with Bash support · Phoronix · accessed 2026-10-01
  15. ResearchCVE-2026-102697 - Ollama 0.14.0 before 0.31.2 experimental agent Bash · HOL Guard · accessed 2026-10-01

Press brief

In one sentence

Ollama is a popular tool for running large language models on your own computer. Its experimental 'agent mode' lets the model run Bash commands after the user approves them, but the approval check only looks at the start of a command. An attacker who can influence the model through prompt injection can chain other commands onto an approved one and get them run. Tracked as CVE-2026-102697, the flaw affects versions 0.14.0 up to, but not including, 0.31.2, and there is no known exploitation so far.

Key facts

Severity
CVSS 4.0 8.5; CVSS 3.1 7.8 (both scored by the CNA VulnCheck in the CVE record) cveawg.mitre.org
Affected versions
0.14.0 up to, not including, 0.31.2 cveawg.mitre.org
CVE published
2026-09-29 (CNA: VulnCheck) cveawg.mitre.org
Credited finder
Akıner Kısa vulncheck.com
NVD status
Awaiting analysis services.nvd.nist.gov

Confirmed

  • The CVE record and VulnCheck both say versions 0.14.0 up to (not including) 0.31.2 are affected.
  • The agent mode's Bash approval check doesn't parse shell syntax properly, so extra commands can be chained onto an approved one.
  • Not in CISA KEV as of 2026-10-01; CISA's SSVC recorded no known exploitation as of 2026-09-29.

Unconfirmed / disputed

  • Whether 0.31.2 really fixes it: the CNA's patch commit a2b3a5e is in v0.31.2, but the commit isn't described as a security fix, the primary data doesn't show whether it actually corrects the approval logic, and as of 2026-10-07 Ollama's GitHub security advisories page lists no published advisories.
  • Whether 0.14.0 pre-releases (such as 0.14.0-rc2) are affected: Phoronix reports that agent mode was already added in 0.14-rc2, but the CNA's range (semver, from 0.14.0) does not include rc versions, and we have not read the rc code.
  • The 0.31.2 release date: the release page shows 6 July, but the rc2 tag on the same commit shows 7 July. The sources disagree.
  • Whether the issue was public before a fixed release existed, and whether it was exploited before a fix, cannot be confirmed.
  • We found no security advisory from Ollama for this CVE in the sources we reviewed.

Quotable line

Approving a command by its first few words is like approving a parcel by its return address without ever looking inside.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "Ollama experimental agent mode Bash approval bypass: only the start of a command is checked, so commands chained after it also get through". PlainCVE. https://plaincve.date/en/vulns/cve-2026-102697-ollama-agent-bash-approval-bypass (accessed YYYY-MM-DD)
BibTeX
@misc{cve2026102697ollamaagentbashapprovalbypass2026,
  title  = {Ollama experimental agent mode Bash approval bypass: only the start of a command is checked, so commands chained after it also get through},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-102697-ollama-agent-bash-approval-bypass},
  note   = {Updated 2026-10-07}
}