Kubeflow Model Registry: Server-side request forgery in InferenceService controller

Summary

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery (SSRF) vulnerability in the InferenceService controller, which processes the modelregistry.kubeflow.org/url annotation. An authenticated user with access to a namespace can point this annotation at an attacker-controlled server, causing the controller to send its ServiceAccount bearer token there. With the stolen token, the attacker can modify other tenants' InferenceServices cluster-wide.

Affected

• Kubeflow Model Registry (now Kubeflow Hub) versions 0 through 0.3.17
• Default configuration: unaffected (according to the CNA record)

Fixed in

Unknown. No fixed version has been confirmed by the vendor.

Workaround

No vendor-published workaround found. Suggested mitigations:

• Restrict who can create or edit InferenceServices and their annotations using Kubernetes RBAC.
• Limit the controller's outbound network access with network policies.
• Review existing InferenceServices for unexpected modelregistry.kubeflow.org/url annotations.

Exploitation

• No evidence of exploitation in the wild found.
• No confirmed public proof of concept found; a technical write-up exists but could not be verified.
• CISA SSVC: exploitation status 'poc', not automatable.
• EPSS 0.00305 (low).

Our recommendation

• Check whether Kubeflow Model Registry or Kubeflow Hub is deployed and which version runs.
• If version 0.3.17 or earlier is in use, restrict InferenceService creation and annotation changes to trusted administrators now.
• Review existing InferenceServices for unexpected url annotations and monitor cluster-wide InferenceService changes.
• Plan an upgrade once the maintainers confirm a fixed release.
• If abuse is suspected, rotate the controller's ServiceAccount token.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Kubeflow Hub repository github.com
• VulnCheck advisory www.vulncheck.com
• OSV record CVE-2026-110220 osv.dev
• Kubeflow Hub releases github.com
• Controller main.go at v0.3.17 github.com
• Controller source at v0.3.17 github.com
• Technical write-up (HackMD) hackmd.io
• VulDB entry 417951 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 14:26.