AI on Kubernetes: Default Helm Chart Security Configurations and Lateral Movement Risks
Source Reddit NetSec
Discussion
A technical audit evaluated the default security configurations of 15 official Helm charts used for AI serving, vector databases, and Model Context Protocol (MCP) agents on Kubernetes. Key findings include plaintext secret handling, unauthenticated remote code execution, and over-privileged agent access due to insecure default settings. Standard static analysis tools failed to detect some issues in Custom Resource Definitions. The report provides reproducible test commands, network logs, and remediation advice. No active exploits are reported, and the findings are based on local test cluster probes.
r/netsec (opens in a new tab)u/No-Peanut-69880 points0 comments
A technical audit evaluating the security defaults of 15 official Helm charts used for AI serving, vector databases, and Model Context Protocol (MCP) agents (including KubeRay, vLLM, LiteLLM, Qdrant, Weaviate, and Flux159 MCP).
Key findings from static manifest analysis and live single-pod lateral movement probes on a test cluster:
- Plaintext Secret Handling: LiteLLM database migration Job embeds raw database passwords in container environment variables (F-13).
- Unauthenticated Remote Code Execution: KubeRay defaults accept unauthenticated job submissions via HTTP, running commands inside a container with passwordless sudo access.
- Over-privileged Agent Access: Flux159 Kubernetes MCP server mounts a ClusterRole with cluster-wide Secret read and pod exec permissions, exposed without an authentication token over HTTP.
- Static Scanners vs CRDs: Standard static analysis tools (Checkov, Trivy, Kubescape) failed to inspect pods nested inside Custom Resource Definitions like Ray clusters.
The paper documents reproducible test commands, network capture logs, and remediation Helm snippets. Scrubbed raw probe logs and results tables are available on GitHub: https://github.com/Sorami-Consulting-AU/ai-kubernetes-helm-chart-security