{
 "id": "AIR-2026-1013",
 "slug": "cve-2026-34940-command-injection-vulnerability-in-kubeai-inf",
 "title": "CVE-2026-34940: Command injection vulnerability in KubeAI inference operator",
 "summary": "Unsanitized model URL components in KubeAI allow attackers with access to model custom resources to execute arbitrary shell commands inside model server pods. The issue has been patched in version 0.23.2.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "KubeAI"
 ],
 "incident_date": "2026-04-06",
 "incident_date_precision": "day",
 "first_reported": "2026-04-06",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34940",
   "publisher": "NVD",
   "title": "CVE-2026-34940: KubeAI is an AI inference operator for kubernetes.",
   "published_at": "2026-04-06"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-34940",
  "command-injection"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}