🕵️ RESEARCH & DEEP DIVES
- Audit: 10 of 14 AI Helm charts ship with API auth disabled by default
A Sorami audit of 15 official AI-related Helm charts found most ship insecure defaults, including unauthenticated APIs, root execution, and over-privileged RBAC.- Applies to teams running AI serving, vector databases, LLM gateways and MCP agent tools on Kubernetes via official Helm charts (vLLM, KubeRay, LiteLLM, Qdrant, Weaviate, Milvus, Ollama, Open WebUI, LocalAI, Langfuse, n8n, KServe, AIBrix, MCP servers).
- 10 of 14 charts with an API omit native authentication by default; all 6 tested live answered unauthenticated requests.
- KubeRay defaults accept unauthenticated job submissions via HTTP that run commands in a container with passwordless sudo; the Flux159 MCP server exposes cluster-wide Secret read and pod exec without authentication.
- 10 of 15 charts do not enforce non-root execution (7 combine this with unauthenticated access); LiteLLM's migration Job embeds the PostgreSQL password in plain-text environment variables (F-13).
- 14 of 15 charts ship no default NetworkPolicy and all 15 mount ServiceAccount tokens by default; 4 of 15 grant cluster- or namespace-wide Secret read access.
🔓 CVEs & KEV
- CVE-2026-100740 — D-Link DIR-895L — CVSS 8.6 — D-Link DIR-895L L2TP Out-of-Bounds Write Enables Remote Code Execution