{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110220", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-13T17:59:34.697Z", "datePublished": "2026-10-13T18:50:07.237Z", "dateUpdated": "2026-10-13T18:50:07.237Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-13T18:50:07.237Z"}, "datePublic": "2026-10-13T00:00:00.000Z", "title": "Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation", "descriptions": [{"lang": "en", "value": "Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "affected": [{"vendor": "Kubeflow", "product": "Model Registry", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "0.3.17", "status": "affected", "versionType": "semver"}], "repo": "https://github.com/kubeflow/hub"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding", "tags": ["third-party-advisory"]}, {"url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.go#L268-L292", "tags": ["technical-description"]}, {"url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.go#L420-L423", "tags": ["technical-description"]}, {"url": "https://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go#L224-L228", "tags": ["technical-description"]}, {"url": "https://github.com/kubeflow/hub", "tags": ["product"]}, {"name": "VulnCheck Advisory: Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/kubeflow-model-registry-through-0.3.17-ssrf-via-inferenceservice-controller-url-annotation"}], "credits": [{"lang": "en", "value": "hieuPenguinnn", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Model Registry", "repo": "https://github.com/kubeflow/hub", "vendor": "Kubeflow", "versions": [{"lessThanOrEqual": "0.3.17", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide."}], "id": "CVE-2026-110220", "lastModified": "2026-10-13T19:30:29.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-10-13T19:18:46.413", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/kubeflow/hub"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go#L224-L228"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.go#L268-L292"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.go#L420-L423"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/kubeflow-model-registry-through-0.3.17-ssrf-via-inferenceservice-controller-url-annotation"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "github.com/kubeflow/hub: Kubeflow Model Registry: Privilege escalation via Server-Side Request Forgery in InferenceService annotation", "id": "2550792", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550792"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.", "A flaw was found in Kubeflow Model Registry. This Server-Side Request Forgery (SSRF) vulnerability allows an authenticated namespace user to provide an attacker-controlled address within an InferenceService resource annotation. When the controller processes the resource, it makes an outgoing request to the specified address and forwards its own service account authentication token. An attacker can capture this credential to escalate privileges and modify other tenants' workloads across the cluster."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-110220", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-model-registry-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-10-13T18:50:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110220\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110220\nhttps://github.com/kubeflow/hub\nhttps://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go#L224-L228\nhttps://github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.go#L268-L292\nhttps://github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.go#L420-L423\nhttps://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding\nhttps://www.vulncheck.com/advisories/kubeflow-model-registry-through-0.3.17-ssrf-via-inferenceservice-controller-url-annotation"], "statement": "This vulnerability is rated as Important because an authenticated user with permissions to deploy workloads in a multi-tenant Red Hat OpenShift AI environment can breach namespace boundaries and escalate privileges cluster-wide. When reconciling serving custom resources, the model registry controller dispatches requests containing its bearer credentials to user-specified destinations defined in resource metadata. Although exploitation requires existing access to create resources within at least one project, the captured controller token grants broad authority to modify other tenants' model serving infrastructure.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.3.17]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Model Registry", "source": "cna", "vendor": "Kubeflow"}, "product": "model_registry", "vendor": "kubeflow"}], "created": "2026-10-17T06:15:04.516245+00:00", "updated": "2026-10-21T20:24:20.151655+00:00", "vendors": ["kubeflow", "kubeflow$PRODUCT$model_registry"]}