2026-09-29
HighPrimaryAnalysis of CVE-2026-102697, where Ollama experimental agent mode could execute appended shell commands that were not covered by the user's session approval.
What happened
In the disclosed scenario, prompt injection influences the victim's agent to append shell control operators and extra commands to a command that the user approved, and Ollama executes the added operations without another session approval.
Why it matters
Potential unauthorized shell execution with access to the files, credentials, processes, and network capabilities available to the Ollama agent runtime. No real-world exploitation is reported.
Missing authorization check
An execution-time decision over the complete canonical shell payload, including operators and arguments, with a digest match between the approved request and the command delivered to the shell.
Would PP block it?
The prompt injection may still influence model output, but appended operators or commands change the payload digest. Without a matching receipt for the full operation, execution fails closed instead of inheriting authority from an approved prefix.
Incident analysis
2026-07-02
The CVE record identifies this as the public disclosure date for the Ollama experimental agent-mode authorization flaw.
2026-09-29
VulnCheck publishes CVE-2026-102697 with affected versions and the 0.31.2 fix boundary.
Authorization boundary
This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
A Tool-Call Gate outside the model-facing approval parser can require a receipt for the exact complete command and reject any payload whose canonical digest differs from what the user approved.
Start small
This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.