Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-34940KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods

High 8.7

In plain English

A high-severity OS command injection in kubeai from kubeai-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components (ref, modelParam). This shell command is executed via bash -c as a Kubernetes startup probe. An attacker who can create or update Model custom resources can inject arbitrary shell commands that execute inside model server pods. This vulnerability is fixed in 0.23.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/kubeai-project/kubeai	0.23.2	GHSA-324q-cwx9-7crr
Go	github.com/kubeai-project/kubeai	0.23.2	GO-2026-4920

Affected products (as reported)

Vendor	Product	Versions
kubeai-project	kubeai	< 0.23.2

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/kubeai-project/kubeai/security/advisories/GHSA-324q-cwx9-7crr x_refsource_CONFIRM