OS Command Injection in KubeAI via Model URL (CVE-2026-34940)

KubeAI constructs a Kubernetes startup probe shell script by interpolating Model CRD URL components (ref, modelParam) into a bash -c command via Go’s fmt.Sprintf. Shell metacharacters in these fields are not sanitized, so any user holding only Model CRD create/update RBAC — not cluster-admin — can achieve arbitrary command execution inside the model server pod.

Root Cause

The startup probe script is built via unsanitized string interpolation of user-controlled Model CRD fields into a bash -c invocation.

Attack Vector

1. Obtain RBAC permission to create/update Model custom resources (a low-privilege role in many clusters).
2. Set the model ref or modelParam field to a value containing shell metacharacters and a command payload.
3. KubeAI reconciles the CRD and starts a pod whose startup probe runs the crafted shell command.

Impact

Command execution inside the model-serving pod for any user with Model CRD write access, without needing cluster-admin privileges.

PoC Script

See poc.yaml in this folder.

1

kubectl apply -f poc.yaml

Applies a malicious Model CRD whose ref/modelParam fields inject a shell command into the generated startup probe.

Signs of compromise:

• Unexpected shell metacharacters in Model CRD manifests
• Anomalous process trees inside KubeAI-managed pods

• Source repository

Mirrored from https://github.com/romain-deperne/CVE-2026-34940 on 2026-07-05.