High severity8.7NVD Advisory· Published Apr 6, 2026· Updated Apr 15, 2026
CVE-2026-34940
CVE-2026-34940
Description
KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components (ref, modelParam). This shell command is executed via bash -c as a Kubernetes startup probe. An attacker who can create or update Model custom resources can inject arbitrary shell commands that execute inside model server pods. This vulnerability is fixed in 0.23.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/kubeai-project/kubeaiGo | < 0.23.2 | 0.23.2 |
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/kubeai-project/kubeai/security/advisories/GHSA-324q-cwx9-7crrnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-324q-cwx9-7crrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-34940ghsaADVISORY
News mentions
0No linked articles in our index yet.