CVE-2026-13451

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious storageUri. This Server-Side Request Forgery SSRF vulnerability allows the storage-initializer init container to issue...

CVE-2026-13451

A Server-Side Request Forgery (SSRF) vulnerability exists in KServe . A namespace-scoped user with permissions to create or update InferenceService custom resources can exploit this by providing a malicious storageUri. This flaw allows the storage-initializer init container to trigger arbitrary o...

EUVD-2026-112458

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious storageUri. This Server-Side Request Forgery SSRF vulnerability allows the storage-initializer init container to issue...

CVE-2026-13451 Kserve: kserve: server-side request forgery via malicious storageuri

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious storageUri. This Server-Side Request Forgery SSRF vulnerability allows the storage-initializer init container to issue...

PT-2026-129170

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious storageUri. This Server-Side Request Forgery SSRF vulnerability allows the storage-initializer init container to issue...

CVE-2026-110220

A flaw was found in Kubeflow Model Registry. This Server-Side Request Forgery SSRF vulnerability allows an authenticated namespace user to provide an attacker-controlled address within an InferenceService resource annotation. When the controller processes the resource, it makes an outgoing reques...

CVE-2026-110220

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110220 Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110220

The Kubeflow Model Registry (versions through 0.3.17 ) is vulnerable to a Server-Side Request Forgery (SSRF) flaw. The root cause lies in the handling of the modelregistry.kubeflow.org/url annotation within the InferenceService Controller . This allows namespace users to create an InferenceServic...

CVE-2026-110220 Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110220 Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

EUVD-2026-99261

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

PT-2026-111844

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110220: Server-Side Request Forgery (SSRF)

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

Kubeflow Hub server request forgery vulnerability

Kubeflow Hub versions 0.3.17 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from an issue with server-side request forgeing in the modelregistry.kubeflow.org/url annotation. It may allow namespace users to steal the controller ServiceAccount token. By...