Kubeflow Pipelines: unvalidated S3/MinIO endpoint in the UI proxy allows unauthenticated SSRF

Impact

The ml-pipeline-ui frontend accepts an attacker-supplied object-store endpoint (providerInfo.Params.endpoint for source=s3/minio, and S3-compatible endpoint metadata from workflow status for archived pod logs) without requiring it to match the operator-configured storage. In the shipped authorization-disabled standalone configuration an unauthenticated caller can make the shared UI pod fetch arbitrary reachable hosts and return the response body, turning the pipelines UI into an SSRF pivot into the cluster network - node metadata services, in-cluster APIs, and other tenants' services that are not exposed externally. Requests signed with the configured object-store credentials can also disclose an access-key identifier. On an ML cluster this pod typically sits in the same namespace as pipeline storage credentials and is reachable by every data scientist, so it is a cheap foothold for lateral movement. Multi-user secret-backed metadata stays restricted to the server namespace, which limits the credential exposure.

Who can reach it

Anyone who can reach the ml-pipeline-ui service. In the standalone (authorization-disabled) deployment no authentication is needed; in multi-user deployments an authenticated cluster user.

What to do

Upgrade Kubeflow Pipelines to 2.18.0 and roll the ml-pipeline-ui deployment - a standard Kubernetes rollout, no node drain or GPU workload interruption. Until then, do not run the authorization-disabled standalone configuration on a shared or reachable network, and restrict network egress from the UI pod with a NetworkPolicy.

References

Related entries

• Unsloth Zoo: model config.json injects Python that runs via exec() when a model is loadedCVE-2026-93348 · Unsloth / Unsloth Zoo (get_transformers_model_type model-loading compile path)High
• Ollama: agent-mode Bash approval does not parse shell syntax, so appended commands run unapprovedCVE-2026-102697 · Ollama experimental agent mode (Bash tool approval parser, x/agent/approval.go)High
• AWS databases-on-aws agent plugin: crafted database command in agent context runs OS commands on the hostCVE-2026-107322 · Amazon Agent Plugins for AWS, databases-on-aws plugin (agent command helper)High
• BentoML: newline in docker.env keys injects Dockerfile instructions during bentoml containerizeCVE-2026-112264 · BentoML (containerize, legacy base.j2 Dockerfile template)High
• llama.cpp: crafted GGUF vocabulary writes before the heap buffer during model loadCVE-2026-116816 · llama.cpp (llm_tokenizer_plamo2::build GGUF vocabulary parsing)High
• Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High