Go/github.com/kubeai-project/kubeai CVE-2026-34940: high 8.8, EPSS 0.47%
KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods in github.com/kubeai-project/kubeai
Action: Upgrade github.com/kubeai-project/kubeai to 0.23.2 or later.
go get github.com/kubeai-project/kubeai@v0.23.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.23.2 | - |
Fixed versions
| 0.23.2 |
Sources
- osv: GO-2026-4920
- nvd: CVE-2026-34940
- https://github.com/kubeai-project/kubeai/security/advisories/GHSA-324q-cwx9-7crr
CVE-2026-34940 · published · modified · JSON