Read the docs
TI-2026-65467 Aliases CVE-2026-102697GHSA-44m8-pr79-3734

Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization

Priority LOW 38CWE-863Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00146 3rd percentileScored 2026-11-07
Fix Fixed ollama (ollama): 0.31.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ollamaollama0.14.0 to before 0.31.20.31.2Patch availableCNA
  • ollama Vendorollama Affected 0.14.0 to before 0.31.2 Fixed in 0.31.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*——ollama
  • cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:* Versions — — ·ollama

Remediation

  • Fix · CNA ollama (ollama) Fixed in 0.31.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102697
  2. 2026-10-03 Alias added: GHSA-44m8-pr79-3734
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Other 4

  • TI-2024-24572 Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex… CVSS 3.1HIGH 8.8
  • TI-2025-14153 Ollama Multi-Modal Model Image Processing NULL Pointer Dereference CVSS 4.0HIGH 8.7
  • TI-2024-26641 An issue was discovered in Ollama before 0.1.46. CVSS 3.1HIGH 8.2
  • TI-2025-41098 An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via… CVSS 3.1HIGH 7.5
  • TI-2025-41097 An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder CVSS 3.1HIGH 7.5
  • TI-2025-01720 Improper Validation of Array Index in ollama/ollama CVSS 3.0HIGH 7.5
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences