CVE-2026-102697
Description
A flaw was found in Ollama. The experimental agent mode fails to properly parse shell syntax within its command approval mechanism. An attacker capable of manipulating model output through prompt injection can append shell control operators to approved commands. This flaw allows the attacker to bypass the approval requirement and execute arbitrary commands on the host system.
Statement
A flaw of Important severity was found in Ollama, which is available to Fedora users as the community-maintained ollama package. Ollama's experimental agent mode does not properly parse shell syntax in the Bash tool approval mechanism, so the approval only covers part of the submitted command line. An attacker who can influence model output, for example through prompt injection, can append shell control operators (such as semicolons or logical operators) to a command; when the user approves the seemingly safe base command, the additional commands execute on the host without further approval. Exploitation requires a local agent session and user interaction to approve the crafted command, and results in arbitrary command execution with the privileges of the user running Ollama, allowing that user's data and system to be read, modified, or disrupted. Red Hat rates this flaw Important with a CVSS 3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); the upstream CVSS 4.0 score of 8.5 reflects the newer scoring version rather than a materially different view of the vulnerability. Within Red Hat's scope, only the Fedora community ollama package is affected and a fix is being pursued through the Fedora community maintainers; no Red Hat-maintained products are affected.
Mitigation
This flaw affects only Ollama's experimental agent mode. Users can avoid exposure by refraining from using the experimental agent mode and its Bash tool until a corrected version is installed. Upstream fixed this issue in Ollama 0.31.2; users who can upgrade should update to Ollama 0.31.2 or later, and Fedora users should apply the corrected ollama package once it is released by the Fedora community maintainers.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
