CVE-2026-34940
8.7 · High
OS command injection in KubeAI through the Ollama startup probe
A user allowed to create KubeAI Model resources could run shell commands inside model pods by adding metacharacters to the model URL.
Language and package
Go
Go projects.
1 write-up, 1 vulnerability
Vulnerabilities
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-34940 | KubeAI | Command injection through the Model URL in the Ollama startup probe | 8.7 High |