Does Ollama have known security vulnerabilities?

Yes. The Injection has tracked 1 story about Ollama with a published CVE: CVE-2026-102697 (CVSS 8.5), chained shell commands skip Bash approval. Check each story for fixed versions.

What is the latest Ollama security issue?

The most recent story is "PoeLLM: a cryptomining botnet feeds on exposed LiteLLM servers" (high severity), disclosed October 7, 2026 by Black Lotus Labs. PoeLLM is a cryptomining botnet that breaks into internet-facing AI services, which Black Lotus Labs says has reached more than 3,400 servers since April 2026. Infected hosts read their next command server from a poem hosted on GitHub.

Which attack techniques have been used against Ollama?

Stories about Ollama on The Injection most often involve ai threat intelligence, remote code execution (rce), mcp (model context protocol), approval bypass. Each technique has a glossary entry with a definition and every related story.

Ollama security

A runtime for running open-weight models locally, with an experimental agent mode.

The Injection has tracked 3 security stories affecting Ollama since September 29, 2026 (incident 1, research 1, vulnerability 1), 2 rated high or critical. The most recent, disclosed October 7, 2026, is "PoeLLM: a cryptomining botnet feeds on exposed LiteLLM servers".

Stories

High or critical

With a CVE

2026-10-07

Latest disclosure

CVEs

CVE	CVSS	Severity	Story
CVE-2026-102697	8.5	High	Ollama agent mode: chained shell commands skip Bash approval

Every Ollama story

2026-10-07HIGH
Incident · Black Lotus Labs
PoeLLM: a cryptomining botnet feeds on exposed LiteLLM servers
PoeLLM is a cryptomining botnet that breaks into internet-facing AI services, which Black Lotus Labs says has reached more than 3,400 servers since April 2026. Infected hosts read their next command server from a poem hosted on GitHub.
2026-09-30INFO
Research · Google Threat Intelligence Group
Google GTIG: half of 2026 AI flaws hit agent orchestration
Google Threat Intelligence Group tracked 2,076 vulnerabilities in AI software from January 2025 to August 2026, more than 1,500 of them in 2026, and says agent orchestration frameworks account for half of them.
2026-09-29HIGH
Vulnerability · VulnCheck · CVE-2026-102697 · CVSS 8.5
Ollama agent mode: chained shell commands skip Bash approval
CVE-2026-102697 lets prompt-injected output in Ollama's experimental agent mode add commands after an approved one with ;, && or ||, so they run without approval. Ollama 0.14.0 to before 0.31.2 is affected.

Questions people ask

Does Ollama have known security vulnerabilities?: Yes. The Injection has tracked 1 story about Ollama with a published CVE: CVE-2026-102697 (CVSS 8.5), chained shell commands skip Bash approval. Check each story for fixed versions.
What is the latest Ollama security issue?: The most recent story is "PoeLLM: a cryptomining botnet feeds on exposed LiteLLM servers" (high severity), disclosed October 7, 2026 by Black Lotus Labs. PoeLLM is a cryptomining botnet that breaks into internet-facing AI services, which Black Lotus Labs says has reached more than 3,400 servers since April 2026. Infected hosts read their next command server from a poem hosted on GitHub.
Which attack techniques have been used against Ollama?: Stories about Ollama on The Injection most often involve ai threat intelligence, remote code execution (rce), mcp (model context protocol), approval bypass. Each technique has a glossary entry with a definition and every related story.