---
cve: "CVE-2026-102697"
severity: "HIGH"
cvss: 8.5
epss: "0.1%"
vendor: "ollama"
kev: false
exploited: false
published: "2026-09-29 17:17:08"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-27T14:16:24+01:00"
---

# CVE-2026-102697

> 8.5 HIGH · 🧪 PoC

## Beschreibung

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-09-29 17:28:26
- CNA-CVSS: **8.5** (`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Schwachstellen-Klasse

- **CWE-863** — Incorrect Authorization
  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

## Patch verfügbar (OSV)

- a6293eb5164214f15e7856268f3adddeae1026e2
- a2b3a5e9a3956bc0700a8505580c11faf4da09b5

## BSI-Hinweise (deutsch)

- [Ollama: Schwachstelle ermöglicht Codeausführung](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3634) — _BSI-Einstufung: mittel_
  Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ollama ausnutzen, um beliebigen Programmcode auszuführen.

## Referenzen

- <https://github.com/ollama/ollama/commit/a2b3a5e9a3956bc0700a8505580c11faf4da09b5>
- <https://github.com/ollama/ollama/releases/tag/v0.31.2>
- <https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L204-L206>
- <https://github.com/ollama/ollama/blob/v0.31.1/x/agent/approval.go#L389>
- <https://github.com/ollama/ollama>
- <https://www.vulncheck.com/advisories/ollama-0.14.0-before-0.31.2-experimental-agent-bash-approval-bypass-via-prefix-based-authorization>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-102697/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_