This technical report analyzes security defaults in 15 Helm charts for AI and related Kubernetes workloads, including KubeRay, vLLM, LiteLLM, Qdrant, Weaviate, and Flux159 MCP. The audit found that some charts embed plaintext database passwords in environment variables (LiteLLM), allow unauthenticated job submissions with passwordless sudo inside containers (KubeRay), and expose cluster-wide secret read and pod exec permissions without authentication (Flux159 MCP). Static scanners like Checkov, Trivy, and Kubescape failed to inspect pods nested inside Custom Resource Definitions such as Ray clusters. The report includes detailed evidence, test commands, and remediation Helm snippets to address these issues.

The insecure default configurations can lead to exposure of sensitive credentials, unauthorized remote code execution inside containers, and excessive permissions that allow lateral movement within Kubernetes clusters. These weaknesses increase the risk of compromise in AI-serving environments using these Helm charts. However, no known exploits are reported in the wild, and the findings are based on controlled test cluster probes.

The report provides remediation Helm snippets and hardening advice to fix the insecure defaults. Users should apply these recommended configuration changes to enable authentication, avoid embedding plaintext secrets, and restrict permissions. Since these are default configuration issues, updating Helm chart values to secure settings is the primary mitigation. No vendor patches are indicated; remediation involves configuration hardening as documented in the report.