What’s Vulnerable › Vulnerabilities

CVE-2026-34940: KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-06 · updated 2026-06-17
• Weakness: CWE-78

Description

KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components (ref, modelParam). This shell command is executed via bash -c as a Kubernetes startup probe. An attacker who can create or update Model custom resources can inject arbitrary shell commands that execute inside model server pods. This vulnerability is fixed in 0.23.2.

Affected products

• kubeai-project kubeai: before 0.23.2 — fixed in 0.23.2

How to fix

Upgrade to a fixed version: kubeai-project kubeai 0.23.2. Check the vendor advisory for mitigations.

References

• https://github.com/kubeai-project/kubeai/security/advisories/GHSA-324q-cwx9-7crr
• https://github.com/kubeai-project/kubeai/security/advisories/GHSA-324q-cwx9-7crr

Get alerted when CVE-2026-34940 or the next vulnerability affects your stack