Cpe:2.3:a:kubeflow:model_registry:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3akubeflowmodel_registry/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 14 Oct 2026 04:38:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKubeflow Model Registry Server-Side Request Forgeryhttps://feed.craftedsignal.io/briefs/2026-10-kubeflow-ssrf/Wed, 14 Oct 2026 04:38:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kubeflow-ssrf/Kubeflow Model Registry versions up to 0.3.17 contain a server-side request forgery vulnerability allowing namespace users to exfiltrate ServiceAccount tokens and gain cluster-wide privileges.Kubeflow Model Registry versions through 0.3.17 are susceptible to a server-side request forgery (SSRF) vulnerability identified as CVE-2026-110220. The flaw resides in the handling of the 'modelregistry.kubeflow.org/url' annotation. A malicious actor with standard namespace-level access can manipulate this annotation to force the controller service to make arbitrary outbound HTTP requests. By pointing this annotation to an attacker-controlled listener, the controller transmits its bearer token, which is often a high-privilege ServiceAccount token. Successful exploitation grants the attacker the ability to manage or modify InferenceServices across the entire Kubernetes cluster, effectively breaking tenant isolation and compromising the platform's control plane.

Impact

Successful exploitation allows a low-privileged user to escalate their access to cluster-wide control over InferenceServices. This leads to unauthorized data access, potential exfiltration of proprietary machine learning models, and the ability to manipulate service deployments across multiple tenants. The severity of this vulnerability is rated as 7.1 (High) on the CVSS v3.1 scale.

Recommendation

  • Immediately upgrade Kubeflow Model Registry to a version beyond 0.3.17 to remediate CVE-2026-110220.
  • Audit Kubernetes ServiceAccount permissions to ensure the controller ServiceAccount follows the principle of least privilege.
  • Implement egress network policies to restrict the ability of the Model Registry controller to initiate outbound connections to unauthorized internal or external endpoints.
]]>highadvisorykubernetesssrfcloud-nativekubeflow