AI Threat Brief: Infrastructure Flaws and Supply Chain Risks

This week's security landscape reveals a critical focus on the foundational infrastructure supporting artificial intelligence. Advisories cover remote code execution in the LMCache library, a sandbox escape in Podman, privilege escalation in the KEDA autoscaler, and a supply chain bypass in Claude Code. These incidents demonstrate that attackers are targeting the plumbing of AI systems. A report from Unit 42 on initial access vectors provides context, showing how these specific vulnerabilities fit into broader adversary playbooks. [34]

LMCache RCE: Unsafe Deserialization in AI Caching

A critical remote code execution vulnerability has been disclosed in LMCache, a key-value cache for large language models. The flaw, tracked as CVE-2026-105192, affects the library's multiprocess mode. [3] An unauthenticated attacker with network access to the transport port can execute arbitrary code.

The vulnerability is rated 9.8 for multi-node deployments where the transport is bound to a routable network interface. [1]

The attack relies on an unauthenticated ZeroMQ transport, which by default listens on port 5555. An attacker can send a single crafted message containing a malicious pickle payload. [13] The LMCache server uses `pickle.loads` to deserialize part of the message, which occurs before any authentication or validation checks. This unsafe deserialization leads directly to code execution with the privileges of the LMCache process.

The use of `DeviceIPCWrapper.Deserialize` was the entry point for the pickled data. [12]

The root cause is the use of Python's insecure `pickle` module on untrusted network input. [11] The vulnerability was introduced in version 0.3.9 and persists through version 0.5.5.

Official container images for LMCache ran the process as the root user, compounding the issue by making successful exploitation more damaging. [2]

The project has since changed official images to run as a non-root user. [6]

The project has published a post-mortem on the incident. [10]

A fix is available in LMCache version 0.5.6. The patch replaces pickle with a versioned, typed MessagePack format that is validated before use. [4] The implementation was handled across several commits.

[7] This new format is validated before use to prevent deserialization attacks.

[8] Both ZeroMQ and gRPC transport paths are now covered by this safer method.

[9] The update also changes the example Kubernetes deployment to bind to localhost.

[5] Operators should upgrade all workers and servers. If an immediate upgrade is not possible, access to the transport port should be restricted via firewall rules.

Podman Sandbox Escape via Image Annotation

A serious vulnerability in Podman, CVE-2026-94603, allowed a malicious container image to disable its own sandboxing. [16] The flaw permitted an image to control its own execution environment, bypassing security settings specified by the operator at runtime. The issue affected the `podman run` command when used with a specially crafted image.

The vulnerability stemmed from a feature that allowed container checkpoints to be distributed as OCI images. An attacker could add a specific annotation, `io.podman.annotations.checkpoint.runtime.name`, to a standard container image. [15] When `podman run` encountered this annotation, it treated the image as a checkpoint. This process silently ignored all user-supplied security options, such as dropped capabilities, and instead applied the insecure configuration defined within the image.

This conflation of container images and checkpoints allowed for inherently insecure behavior. [14]

This vulnerability was discovered by ADA Logics using Anthropic's Claude models, a notable instance of AI assisting in security research. [15] The Podman maintainers determined that conflating images and checkpoints was inherently unsafe and reverted the feature entirely. The reversion was first applied to the main development branch.

[18] Additional commits completed the removal there.

[21]

The fix was then backported to the v6.1 release branch. [19] A separate backport was created for the v5.8 branch.

[20] The v6.1 backport involved several commits to fully revert the feature.

[22] The v5.8 backport was also completed across commits.

[17] Patched versions are now available, including Podman v5.8.8.

[23] Podman v6.1.3 also contains the fix.

[24] Operators should upgrade their installations. Rootless containers were not affected.

KEDA Flaw Allows Cluster Takeover from Namespace

A critical privilege escalation vulnerability in the Kubernetes Event-driven Autoscaler (KEDA) has been disclosed. The flaw, CVE-2026-77524, allows a user with permissions in a single namespace to escalate their privileges to full cluster administrator. [27] This effectively breaks the multi-tenancy security model in clusters where KEDA is installed.

The issue allows a namespace admin to steal the KEDA operator's service account token. [25]

An attacker with rights to create `TriggerAuthentication` and `ScaledObject` resources in a namespace can exploit the flaw. They configure an object that directs the KEDA operator to authenticate to an attacker-controlled endpoint. [26] The operator then sends its own high-privilege ServiceAccount token to the attacker's server. This token grants cluster-wide permissions to read all secrets and manage workloads, leading to a full cluster compromise.

The vulnerability was an incomplete fix for a previous advisory. The destination address for the authentication was not validated, allowing the operator to send its credentials to any URL. This issue was found by a researcher with assistance from the Claude Opus AI model. This highlights a growing trend of AI-assisted vulnerability discovery.

The KEDA team has released version 2.21.0, which contains a fix. [29] The patch ensures that authentication targets are properly validated.

The fix was implemented in a single commit. [28] Administrators are urged to upgrade their KEDA installations immediately. They should also audit existing `TriggerAuthentication` objects for any suspicious configurations.

Claude Code Plugin Install Flaw Bypasses Hash Pinning

A supply chain vulnerability in Claude Code and Claude Desktop allowed for a bypass of security hash pinning during plugin installation. The issue, CVE-2026-86063, could allow an attacker to execute arbitrary code on a user's machine by tricking the installer into loading a malicious plugin version. [32] This type of flaw undermines the trust model of curated plugin marketplaces.

The issue could result in attacker-controlled code being installed. [30]

The attack exploited how the tool handled git checkouts. The installer would check out a plugin using a pinned commit SHA but failed to verify that the resulting code actually matched that SHA. An attacker who controlled a plugin's repository could create a branch with a name identical to a valid commit hash. [31] The `git checkout` command would silently prioritize the branch, leading to the installation of attacker-controlled code.

The vulnerability was reported by a security researcher from Air Security. The root cause was the lack of verification after the checkout operation. Exploitation was possible if a plugin's source repository was hosted on a git platform that allowed branch names shaped like 40-character commit SHAs. Users who had auto-update enabled have already received the patch. [33]

Common Threads

The vulnerabilities this week share a common target: the infrastructure that enables AI. From LMCache's caching layer to KEDA's scaling logic and Podman's container execution, these are not flaws in the models themselves. They are deep-seated security issues in the software supply chain and operational tooling that developers and operators depend on. This pattern indicates a shift in the attack surface that defenders must now prioritize.

A second, equally important thread is the emerging role of AI in security research. The Podman and KEDA vulnerabilities were both discovered with assistance from large language models. This demonstrates that AI is becoming a powerful tool for discovering complex logical flaws. While attackers may also use these tools, their growing use by defenders represents a significant evolution in vulnerability discovery.

Defender Takeaway

Securing AI systems requires a defense-in-depth approach that goes beyond the model. This week's events prove that fundamental security hygiene is critical. The LMCache and KEDA exploits were made possible by exposed network ports and excessive permissions. Hardening the infrastructure, implementing the principle of least privilege, and maintaining strict network segmentation are not optional. They are essential prerequisites for safely deploying any AI workload.