CVE-2026-34940
|
| |
|
|
Software afectado |
KUBERNETES |
|
|
|
KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components (ref, modelParam). This shell command is executed via bash -c as a Kubernetes startup probe. An attacker who can create or update Model custom resources can inject arbitrary shell commands that execute inside model server pods. This vulnerability is fixed in 0.23.2. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-34940 |
