CVE-2026-102697

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-102697

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102697.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-102697

Published

2026-09-29T16:46:08Z

Modified

2026-10-01T03:47:29Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization

Details

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102697.json"
}

References

Affected packages

Git / github.com/ollama/ollama

Affected ranges

Type

GIT

Repo

https://github.com/ollama/ollama

Events

Introduced

02a24015968d612b418448b73cffaa1b0652d161

Fixed

a6293eb5164214f15e7856268f3adddeae1026e2

Fixed

a2b3a5e9a3956bc0700a8505580c11faf4da09b5

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.14.0"
        },
        {
            "fixed":  "0.31.2"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.14.0

v0.14.0-rc11

v0.14.1

v0.14.2

v0.14.2-rc0

v0.14.2-rc1

v0.14.3

v0.14.3-rc0

v0.14.3-rc1

v0.14.3-rc2

v0.14.3-rc3

v0.15.0

v0.15.0-rc0

v0.15.0-rc1

v0.15.0-rc2

v0.15.0-rc3

v0.15.0-rc4

v0.15.0-rc5

v0.15.0-rc6

v0.15.1

v0.15.1-rc0

v0.15.1-rc1

v0.15.2

v0.15.3

v0.15.4

v0.15.5

v0.15.5-rc0

v0.15.5-rc1

v0.15.5-rc2

v0.15.5-rc3

v0.15.5-rc4

v0.15.5-rc5

v0.15.6

v0.16.0

v0.16.0-rc0

v0.16.0-rc1

v0.16.0-rc2

v0.16.1

v0.16.2

v0.16.2-rc0

v0.16.3

v0.16.3-rc0

v0.16.3-rc1

v0.16.3-rc2

v0.17.0

v0.17.0-rc0

v0.17.0-rc1

v0.17.0-rc2

v0.17.1

v0.17.1-rc0

v0.17.1-rc1

v0.17.1-rc2

v0.17.2

v0.17.3

v0.17.4

v0.17.5

v0.17.6

v0.17.7

v0.17.7-rc0

v0.17.7-rc1

v0.17.7-rc2

v0.17.8-rc0

v0.17.8-rc1

v0.17.8-rc2

v0.17.8-rc3

v0.17.8-rc4

v0.18.0

v0.18.0-rc0

v0.18.0-rc1

v0.18.0-rc2

v0.18.1

v0.18.1-rc0

v0.18.1-rc1

v0.18.2

v0.18.2-rc0

v0.18.2-rc1

v0.18.3

v0.18.3-rc0

v0.18.3-rc1

v0.18.3-rc2

v0.18.4-rc0

v0.18.4-rc1

v0.19.0

v0.19.0-rc0

v0.19.0-rc1

v0.19.0-rc2

v0.20.0

v0.20.1

v0.20.1-rc0

v0.20.1-rc1

v0.20.1-rc2

v0.20.2

v0.20.3

v0.20.3-rc0

v0.20.4

v0.20.4-rc0

v0.20.4-rc1

v0.20.4-rc2

v0.20.5

v0.20.5-rc0

v0.20.5-rc1

v0.20.5-rc2

v0.20.6

v0.20.6-rc0

v0.20.6-rc1

v0.20.7-rc0

v0.20.8-rc0

v0.21.0

v0.21.0-rc0

v0.21.0-rc1

v0.21.1

v0.21.1-rc0

v0.21.1-rc1

v0.21.2

v0.21.2-rc0

v0.21.2-rc1

v0.21.3-rc0

v0.22.1

v0.22.1-rc0

v0.22.1-rc1

v0.23.0

v0.23.0-rc0

v0.23.1

v0.23.2

v0.23.2-rc0

v0.23.3

v0.23.3-rc0

v0.23.3-rc1

v0.23.4

v0.23.4-rc0

v0.24.0

v0.24.0-rc0

v0.24.0-rc1

v0.25.0-rc0

v0.30.0

v0.30.0-rc32

v0.30.1

v0.30.1-rc0

v0.30.10

v0.30.10-rc0

v0.30.10-rc1

v0.30.11

v0.30.11-rc0

v0.30.11-rc1

v0.30.12-rc0

v0.30.2

v0.30.2-rc0

v0.30.3

v0.30.4

v0.30.4-rc0

v0.30.4-rc1

v0.30.5

v0.30.5-rc0

v0.30.6

v0.30.6-rc0

v0.30.7

v0.30.7-rc0

v0.30.7-rc1

v0.30.8

v0.30.8-rc0

v0.30.9

v0.30.9-rc0

v0.30.9-rc1

v0.30.9-rc2

v0.31.0

v0.31.1

v0.31.2-rc0

v0.31.2-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102697.json"