Ollama agent mode bash approval bypass via prompt injection

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in experimental agent mode where the bash tool approval mechanism fails to properly parse shell syntax, allowing attackers to execute additional shell commands through prompt injection.

Disclosed 29 September 2026 · Record updated 1 October 2026

Impact

Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.

Our coverage

A factory worker stamps approval on a blueprint, but invisible ink underneath the stamp reveals additional machinery instructions that weren't part of the original design.

Vulnerabilities

Ollama patches command approval bypass in agent mode

A flaw in the experimental agent mode's bash tool let prompt injection append extra shell commands to ones the user had already approved.

29 Sept 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-102697