Kubeflow Model Registry Server-Side Request Forgery

Kubeflow Model Registry versions through 0.3.17 are susceptible to a server-side request forgery (SSRF) vulnerability identified as CVE-2026-110220. The flaw resides in the handling of the 'modelregistry.kubeflow.org/url' annotation. A malicious actor with standard namespace-level access can manipulate this annotation to force the controller service to make arbitrary outbound HTTP requests. By pointing this annotation to an attacker-controlled listener, the controller transmits its bearer token, which is often a high-privilege ServiceAccount token. Successful exploitation grants the attacker the ability to manage or modify InferenceServices across the entire Kubernetes cluster, effectively breaking tenant isolation and compromising the platform's control plane.

Impact

Successful exploitation allows a low-privileged user to escalate their access to cluster-wide control over InferenceServices. This leads to unauthorized data access, potential exfiltration of proprietary machine learning models, and the ability to manipulate service deployments across multiple tenants. The severity of this vulnerability is rated as 7.1 (High) on the CVSS v3.1 scale.

Recommendation

• Immediately upgrade Kubeflow Model Registry to a version beyond 0.3.17 to remediate CVE-2026-110220.
• Audit Kubernetes ServiceAccount permissions to ensure the controller ServiceAccount follows the principle of least privilege.
• Implement egress network policies to restrict the ability of the Model Registry controller to initiate outbound connections to unauthorized internal or external endpoints.