CVE-2026-102697

Executive Summary

CVE-2026-102697 is an incorrect authorization vulnerability in Ollama's experimental agent mode, specifically within the Bash tool approval mechanism, affecting versions 0.14.0 through 0.31.2. The flaw allows an attacker who can influence model output via prompt injection to bypass the session approval requirement and execute arbitrary additional shell commands by appending control operators (such as semicolons or logical operators) to commands that have already been approved. With a CVSS score of 7.8, successful exploitation results in high confidentiality, integrity, and availability impact on the local host running the Ollama agent, though the attack requires local access and user interaction.

Technical Analysis

Ollama is a popular open-source framework for running large language models (LLMs) locally. The vulnerability resides in the experimental agent mode's Bash tool approval mechanism, which is designed to require explicit user consent before executing shell commands generated by the model. The core issue is an incorrect authorization check (CWE-863) caused by improper parsing of shell syntax.

When the agent proposes a command, the approval mechanism presumably presents the command to the user and, upon approval, executes it. However, the parser fails to correctly identify command boundaries when shell control operators—such as semicolons (;), logical AND (&&), or logical OR (||)—are appended. As a result, an attacker who can inject instructions into the model's context (e.g., through a malicious prompt, poisoned document, or API input) can cause the model to generate a seemingly benign command that the user approves, but which actually contains a second, malicious command following a control operator. The approval mechanism only validates the first command segment, while the shell executes both.

The attack surface is the local machine where Ollama's agent mode is active. The vulnerability does not require network exposure of the Ollama API, although the prompt injection vector could be delivered remotely if the model interacts with external data sources. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that the attacker must have local access or the ability to influence the model's input, low attack complexity, no privileges required, and user interaction (the approval step) is needed. The impact is high across confidentiality, integrity, and availability, as arbitrary command execution with the privileges of the Ollama process (often the user's own account) can lead to data theft, system modification, or denial of service.

No public proof-of-concept or exploit code is available, and no Nuclei template exists. The vulnerability class is well understood: command injection via improper neutralization of special elements (though classified here as incorrect authorization). The lack of a CVE description detailing specific functions or parameters means we cannot identify exact code locations, but the mechanism is clear from the description: shell syntax parsing during approval is insufficient.

Exploitation Scenarios

1) Reconnaissance/target identification: An attacker identifies a system running Ollama versions 0.14.0 to 0.31.2 with experimental agent mode enabled. This could be a developer workstation, a CI/CD runner, or any host where Ollama is used to automate tasks. The attacker may not need direct network access; instead, they could deliver a prompt injection payload through a shared document, a website the model browses, or an API call if the Ollama endpoint is exposed.

2) Triggering the flaw: The attacker crafts input that causes the LLM to generate a Bash command containing a benign first segment followed by a control operator and a malicious second segment. For example, the model might output echo "Hello" ; rm -rf ~/important_data. The user, seeing the first part, approves the command. The approval mechanism, due to incorrect shell syntax parsing, fails to recognize the second command after the semicolon and authorizes execution of the entire string.

3) Payload/execution method: The shell interprets the approved string literally, executing both the benign and malicious commands. The attacker can use any shell control operator (;, &&, ||, |, &, newline) to chain additional commands. The malicious command runs with the privileges of the Ollama process, which is typically the local user's privileges. The attacker could download and execute a reverse shell, exfiltrate files, modify system configurations, or install persistence mechanisms.

4) Post-exploitation impact: Successful exploitation gives the attacker arbitrary command execution on the host. They can escalate privileges if the Ollama process runs with elevated rights, move laterally within the network, steal sensitive data, or disrupt operations. The high integrity and availability impact reflect the potential to alter or destroy data and cause system downtime.

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The reliance on prompt injection means the attacker must be able to influence the model's output, which could be achieved through various means depending on how the agent mode is used.

Impact Assessment

The CVSS score of 7.8 (High) is derived from the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The local attack vector (AV:L) indicates that the attacker must either have local access to the system or be able to deliver a prompt injection payload through a local interface. The low attack complexity (AC:L) means no special conditions are required beyond the ability to influence model output. No privileges are required (PR:N), but user interaction (UI:R) is needed because the user must approve the command. The scope is unchanged (S:U), so the impact is confined to the vulnerable component's security authority. Confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H), reflecting the potential for significant data loss, system compromise, and service disruption.

Business impact includes unauthorized access to sensitive data processed by the LLM or stored on the host, modification of critical files, and potential lateral movement if the host has network access to other systems. The blast radius is typically limited to the individual host running Ollama, but in shared environments (e.g., a developer workstation with access to production credentials or a CI/CD pipeline), the consequences can be severe. The experimental nature of the agent mode means adoption may be limited, but early adopters in DevOps and security research are at risk.

Detection Guidance

Sigma Rule

title: Ollama Agent Mode Command Injection via Shell Control Operators
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects potential exploitation of CVE-2026-102697 where shell control operators are appended to approved commands in Ollama agent mode.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/ollama'
  selection_cmdline:
    CommandLine|contains:
      - '; '
      - ' && '
      - ' || '
      - ' | '
      - '`'
      - '$('
  condition: selection_parent and selection_cmdline
falsepositives:
  - Legitimate use of shell control operators in approved commands
level: high
tags:
  - attack.t1059
  - cve.2026.102697

YARA Rule

rule CVE_2026_102697_Ollama_Command_Injection
{
    meta:
        description = "Detects shell control operators in Ollama agent mode command strings"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "CVE-2026-102697"
        severity = "high"
    strings:
        $s1 = "ollama" nocase
        $s2 = "agent" nocase
        $s3 = "bash" nocase
        $op1 = ";" ascii wide
        $op2 = "&&" ascii wide
        $op3 = "||" ascii wide
        $op4 = "|" ascii wide
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F and
        $s1 and $s2 and $s3 and any of ($op*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102697 Ollama Agent Mode Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/"; http_uri; content:"prompt"; http_client_body; pcre:"/(;|&&|\|\||\|)\s*(rm|curl|wget|bash|sh|nc|python|perl)/i"; reference:cve,2026-102697; classtype:attempted-user; sid:10000001; rev:1;)

Elastic Detection

process where process.parent.name == "ollama" and
  process.command_line regex~ ".*(;|&&|\\|\\||\\|)\\s*(rm|curl|wget|bash|sh|nc|python|perl).*"

Splunk SPL Query

index=main sourcetype=linux_audit OR sourcetype=sysmon
| search (process_name=ollama OR parent_process_name=ollama) AND (process_command_line="*;*" OR process_command_line="*&&*" OR process_command_line="*||*" OR process_command_line="*|*")
| where match(process_command_line, "(;|&&|\|\||\|)\s*(rm|curl|wget|bash|sh|nc|python|perl)")
| table _time, host, user, parent_process_name, process_name, process_command_line

Wazuh OSSEC Rule

<group name="ollama,cve-2026-102697,">
  <rule id="100200" level="12">
    <if_sid>592</if_sid>
    <field name="parent_process">ollama</field>
    <field name="command">(;|&&|\|\||\|)</field>
    <description>CVE-2026-102697: Potential Ollama agent mode command injection via shell control operators</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_102697,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is currently available.

1. Immediate mitigations:

   • Disable the experimental agent mode in Ollama until a patched version is available.
   • Restrict access to the Ollama API (default port 11434) to trusted networks only; avoid exposing it to the internet.
   • Run Ollama with minimal privileges (dedicated non-privileged user) to limit the impact of command execution.
   • Monitor for suspicious process creation events where the parent process is ollama and the command line contains shell control operators.
   • Implement strict input validation and sanitization for any external data sources that feed into the model's context to reduce prompt injection risk.

2. Patch/upgrade steps:

   • There is no official patch or fixed version at this time. Monitor the Ollama GitHub repository and security advisories for updates. Once a patched version is released, upgrade immediately.
   • If a patch becomes available, follow vendor instructions for upgrading Ollama and verify the version after installation.

3. Long-term hardening:

   • Adopt a policy of least privilege for all AI agent processes.
   • Use application sandboxing or containerization (e.g., Docker with restricted capabilities) to isolate Ollama and limit the impact of arbitrary command execution.
   • Implement network segmentation to prevent lateral movement from compromised hosts.
   • Conduct regular security reviews of agent mode features and third-party model integrations.
   • Educate users about prompt injection risks and the importance of scrutinizing commands proposed by AI agents.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-102697
• Ollama GitHub Repository: https://github.com/ollama/ollama
• Ollama Security Advisories: https://github.com/ollama/ollama/security/advisories
• CWE-863: Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1059: Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-102697 at this time.