GPU VulnDB

Database/AI/ML frameworks & serving

Kubeflow Pipelines frontend: unauthenticated SSRF proxy reaches cloud metadata and cluster-internal APIs

CVE-2026-54745AI/ML frameworks & servingcurated

Impact

Anyone who can reach the Pipelines UI can make the frontend issue arbitrary HTTP/HTTPS requests on their behalf, with attacker-chosen method, headers (including Authorization and Cookie) and body, and read the response back. On a GPU cluster the Pipelines frontend sits inside the pod network, so this reaches the cloud instance metadata service, the Kubernetes API server, and any internal service that is otherwise unreachable from outside - which typically means node or workload credentials, and from there the ability to schedule pods onto GPU nodes. The route is excluded from the authorization middleware even with ENABLE_AUTHZ=true, so an operator who believes the UI is protected is not. Scope is marked changed and the record carries a CVSS of 10.0.

Who can reach it

Anyone who can reach the Kubeflow Pipelines frontend service over the network. No authentication and no user interaction required; the route is reachable at several path prefixes and via a crafted Referer header.

What to do

Upgrade Kubeflow Pipelines to 2.17.0 and roll the frontend deployment - a pod restart, no node disruption and no effect on running GPU workloads. Until then, block the /_proxy/ paths (including the /apis/v1beta1/, /apis/v2beta1/ and /pipeline/ prefixes) at the ingress or service mesh, and treat any credentials reachable from the frontend pod's network position as exposed.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-54745https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbddhttps://github.com/kubeflow/pipelines/releases/tag/2.17.0

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.