CVE-2026-34940

KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components (ref, modelParam). This shell command is executed via bash -c as a Kubernetes startup probe. An attacker who can create or update Model custom resources can inject arbitrary shell commands that execute inside model server pods. This vulnerability is fixed in 0.23.2.

• CWE-78

• https://github.com/kubeai-project/kubeai/security/advisories/GHSA-324q-cwx9-7crrExploit, Mitigation, Vendor Advisory
• https://github.com/kubeai-project/kubeai/security/advisories/GHSA-324q-cwx9-7crrExploit, Mitigation, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34935PraisonAI is a multi-agent teams system. From version 4.5.15…9.8
• CVE-2026-34936PraisonAI is a multi-agent teams system. Prior to version 4.…7.7
• CVE-2026-34937PraisonAI is a multi-agent teams system. Prior to version 1.…9.8
• CVE-2026-34938PraisonAI is a multi-agent teams system. Prior to version 1.…10
• CVE-2026-34939PraisonAI is a multi-agent teams system. Prior to version 4.…7.5
• CVE-2026-3494In MariaDB server version through 11.8.5, when server audit …5.3
• CVE-2026-34941Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0…8.1
• CVE-2026-34942Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0…6.5
• CVE-2026-34943Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0…7.5
• CVE-2026-34944Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0…5.7
• CVE-2026-34945Wasmtime is a runtime for WebAssembly. From 25.0.0 to before…6.5
• CVE-2026-34946Wasmtime is a runtime for WebAssembly. From 25.0.0 to before…7.5