Ollama patches command approval bypass in agent mode

Ollama has fixed an authorisation flaw in its experimental agent mode that allowed extra shell commands to run without the user's approval. The issue, tracked as CVE-2026-102697 and published to the US National Vulnerability Database on 29 September 2026, affects Ollama versions from 0.14.0 up to but not including 0.31.2. It is fixed in release 0.31.2.

According to the NVD entry, the bug sits in the approval mechanism for the agent mode Bash tool. That mechanism is meant to ask the user before the agent runs a shell command, and to remember approvals for the session. The entry says the mechanism "fails to properly parse shell syntax". An attacker who can influence what the model outputs, through prompt injection, can therefore append control operators such as semicolons or logical operators to a command that has already been approved. The extra commands run without triggering a fresh approval prompt.

Prompt injection is the technique of planting instructions in content an agent reads, such as a web page, a file or a code comment, so that the model treats them as commands from the user. In this case the injected text does not need to persuade the user to approve anything new. It only needs to ride along with something the user has already said yes to.

The advisory from VulnCheck, listed as a reference on the NVD record, describes the problem as a prefix-based authorisation bypass. That framing matches the technical detail in the NVD summary: the approval check appears to compare the start of a command string rather than analysing the full shell syntax, so anything after a separator escapes scrutiny.

The NVD record links to two specific lines of code in the v0.31.1 release of Ollama's agent approval logic, and to the commit that addresses the issue. It also links to the v0.31.2 release tag. Ollama has not published separate commentary beyond the repository and release references cited in the advisory.

The vulnerability class is listed as incorrect authorisation. Practically, that means the software made a decision about whether an action was permitted, and made it on incomplete information. Approval prompts are the main safety control in agentic coding tools that can touch a local shell, so a parsing gap in that control removes the last step between model output and code execution on the machine.

The affected feature is described in the advisory as experimental, which limits the likely number of users running it in production. Even so, the version range is wide, spanning from 0.14.0 through 0.31.1. Users of Ollama's agent mode should check which version they are running and move to 0.31.2 or later.

No exploitation in the wild is described in the sources, and no severity score is listed in the NVD entry reviewed. The advisory does not say who reported the issue or when it was first disclosed privately to the vendor.