Database/AI/ML frameworks & serving
Kubeflow: SSRF
CVSS 6.5CVE-2023-6570AI/ML frameworks & servingcurated
Impact
SSRF
Who can reach it
Authenticated notebook/pipeline user
What to do
Upgrade; block IMDS egress from Kubeflow pods
References
Related entries
- Gradio: SSRF in the `/proxy` routeCVE-2024-2206 · GradioMedium
- picklescan: ZIP manipulation crashes the scanner (scan bypass by DoS)CVE-2025-1944 · picklescanMedium
- vLLM (`/v1/completions` guided decoding): Invalid `json_schema` kills the serverCVE-2025-48942 · vLLM (`/v1/completions` guided decoding)Medium
- vLLM: unbounded frame count in video/jpeg base64 data URLs crashes the server with OOMCVE-2026-34755 · vLLM OpenAI-compatible API server (video/jpeg base64 multimodal path)Medium
- vLLM: no upper bound on the n parameter lets a single request OOM the API serverCVE-2026-34756 · vLLM OpenAI-compatible API server (ChatCompletionRequest/CompletionRequest n parameter)Medium
- vLLM (revision pinning): Revision pinning does not apply to all model artifactsCVE-2026-47155 · vLLM (revision pinning)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.