CVE-2026-34940: KubeAI Command Injection RCE Vulnerability

CVE-2026-34940 Overview

CVE-2026-34940 is a Command Injection vulnerability affecting KubeAI, an AI inference operator for Kubernetes. Prior to version 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components (ref, modelParam). This shell command is executed via bash -c as a Kubernetes startup probe, allowing attackers who can create or update Model custom resources to inject arbitrary shell commands that execute inside model server pods.

Critical Impact

Attackers with permission to create or modify Model custom resources can achieve arbitrary command execution within model server pods, potentially leading to container escape, data exfiltration, or lateral movement within the Kubernetes cluster.

Affected Products

• KubeAI versions prior to 0.23.2
• Kubernetes clusters running vulnerable KubeAI deployments
• Model server pods managed by the KubeAI operator

Discovery Timeline

• April 6, 2026 - CVE-2026-34940 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34940

Vulnerability Analysis

This vulnerability (CWE-78: OS Command Injection) exists within the KubeAI operator's handling of Model custom resources. The ollamaStartupProbeScript() function dynamically constructs shell commands for Kubernetes startup probes without properly sanitizing input from the Model resource specification.

When a Model custom resource is created or updated, the operator generates a startup probe script that includes model URL components. Because these components are directly interpolated into a shell command string that is subsequently executed via bash -c, an attacker can craft malicious Model resources containing shell metacharacters or command sequences that break out of the intended command context.

The attack surface is exposed to any user or service account with permissions to create or update Model custom resources in the Kubernetes cluster. Successful exploitation results in arbitrary command execution within the context of model server pods, which may have access to sensitive data, service account tokens, or network connectivity to other cluster resources.

Root Cause

The root cause is the use of fmt.Sprintf to construct shell command strings without proper input sanitization or escaping. The ref and modelParam variables from Model custom resource specifications are directly embedded into the command string, allowing shell metacharacters and command separators to be interpreted by the shell when the startup probe executes.

Attack Vector

The attack leverages the network-accessible Kubernetes API to submit malicious Model custom resources. An attacker with appropriate RBAC permissions (create/update on Model resources) can inject shell commands through model URL components. These commands execute when the KubeAI operator processes the resource and configures the startup probe for the model server pod.

The vulnerability can be exploited by embedding shell command sequences (such as $(command) or ; command) within model URL fields. When the startup probe runs, the injected commands execute with the privileges of the model server container, potentially enabling data theft, cryptocurrency mining, lateral movement, or container escape attempts.

Detection Methods for CVE-2026-34940

Indicators of Compromise

• Unusual Model custom resources containing shell metacharacters (;, |, $(), backticks) in URL fields
• Unexpected processes or network connections originating from model server pods
• Anomalous Kubernetes audit logs showing Model resource creation/updates with suspicious content
• Startup probe failures or unusual container behavior in model server pods

Detection Strategies

• Implement Kubernetes admission controllers (OPA Gatekeeper, Kyverno) to validate Model resource specifications for shell injection patterns
• Enable and monitor Kubernetes audit logging for Model resource operations
• Deploy runtime security monitoring on model server pods to detect unexpected command execution
• Use SentinelOne Kubernetes Workload Protection to identify anomalous container behavior

Monitoring Recommendations

• Monitor Kubernetes audit logs for create/update operations on Model custom resources
• Alert on model server pods executing unexpected shell commands or establishing unusual network connections
• Implement container runtime monitoring to detect command injection exploitation attempts

How to Mitigate CVE-2026-34940

Immediate Actions Required

• Upgrade KubeAI to version 0.23.2 or later immediately
• Review existing Model custom resources for potentially malicious content
• Audit RBAC permissions to restrict Model resource creation/modification to trusted service accounts
• Implement admission controller policies to validate Model resource specifications

Patch Information

The vulnerability is fixed in KubeAI version 0.23.2. The fix properly sanitizes model URL components before constructing shell commands for startup probes. Organizations should upgrade to 0.23.2 or later to remediate this vulnerability. For additional details, see the GitHub Security Advisory.

Workarounds

• Restrict RBAC permissions for Model custom resources to only trusted administrators and service accounts
• Implement Kubernetes admission controllers to block Model resources containing shell metacharacters in URL fields
• Apply network policies to limit model server pod connectivity and reduce blast radius
• Enable Pod Security Standards to restrict container capabilities and reduce escape possibilities

# Example: Restrict Model resource permissions via RBAC
kubectl create clusterrole kubeai-model-admin --verb=get,list,watch --resource=models.kubeai.io
kubectl create clusterrolebinding kubeai-model-readonly --clusterrole=kubeai-model-admin --group=developers
# Only grant create/update permissions to trusted administrators