Database/AI/ML frameworks & serving
Jupyter Enterprise Gateway: YAML injection in kernel env vars creates arbitrary Kubernetes resources
Impact
Untrusted kernel environment variables (kernel_working_dir and the other kernel_xxx values used by the manifest template) are interpolated into the Kubernetes manifest without YAML-aware escaping. An attacker can add or overwrite fields - duplicate securityContext keys where the last wins - and inject document separators to emit extra resources entirely, including a privileged pod. The result is arbitrary workload creation with the gateway's service account rights, which on a GPU cluster means a privileged container on a GPU node and a path to the host and to other tenants' work. This is a distinct flaw from the Jinja2 template injection in CVE-2026-44181, though the same release fixes both.
Who can reach it
Anyone who can submit a kernel start request to the Enterprise Gateway endpoint and control KERNEL_* values; per the advisory and CVSS vector, no authentication is required.
What to do
Upgrade to Enterprise Gateway 3.3.0 and restart the gateway daemon - no GPU node drain or reboot required. Before the upgrade lands, limit who can reach the gateway and review recently created pods for unexpected privileged or hostPath specs.
References
Related entries
- ChromaDB: Pre-authentication code injectionCVE-2026-45829 · ChromaDBCritical
- Kubeflow Pipelines frontend: unauthenticated SSRF proxy reaches cloud metadata and cluster-internal APIsCVE-2026-54745 · Kubeflow Pipelines frontend (/_proxy/ route in proxy-middleware.ts)Critical
- Crawl4AI: request-supplied Chromium switches give command execution in the crawler containerCVE-2026-57572 · Crawl4AI Docker API server (browser_config.extra_args passed to Chromium launch arguments)Critical
- ruflo: unauthenticated MCP bridge exposes terminal_execute, yielding a shell and provider API keysCVE-2026-59726 · ruflo MCP bridge (unauthenticated POST /mcp and /mcp/:group in the default docker-compose deployment)Critical
- Xinference: unauthenticated chat request reaches eval() in the Llama3 tool-call parserCVE-2026-61539 · Xinference (Llama3 tool-call parser, `_eval_llama3_chat_arguments`)Critical
- Decepticon: unfiltered ChatML special tokens in crawl results give a target page control of the agentCVE-2026-61732 · Decepticon (LLM message construction from crawl output)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.