KubeAI, an AI inference operator for Kubernetes, has a flaw in versions prior to 0.23.2 that allows an attacker—one who can create or update Model custom resources—to inject arbitrary shell commands into the startup probe script. The shell command incorporates unsanitized model URL components, enabling execution of any command within the model server pod. This vulnerability is a CWE-78 OS Command Injection.

The vulnerability affects KubeAI deployments running any version before 0.23.2, specifically within the Ollama engine startup probe configuration. Administrators should verify the KubeAI version in use and assess whether custom Model resources are exposed to untrusted users.

With a CVSS score of 8.7, the issue is high severity; however, the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits. The likely attack vector requires privileged access to the Kubernetes cluster to create or edit Model custom resources, a privilege typically governed by RBAC. If RBAC is misconfigured, an attacker can immediately trigger command injection and gain unrestricted execution inside model pods.