Red Hat OpenShift AI (RHOAI): Server-side request forgery via storageUri
Summary
A flaw in KServe, shipped with Red Hat OpenShift AI (RHOAI), lets a user with create or update rights on InferenceService resources supply a malicious storageUri. The storage-initializer init container then sends arbitrary outbound HTTP/HTTPS requests from inside the cluster (Server-Side Request Forgery). An attacker can disclose information, including credentials of the node's cloud IAM role, or reach internal cluster services. Exploitation requires a valid, namespace-scoped account.
Affected
- Red Hat OpenShift AI (RHOAI) with KServe components, including the odh-kserve-storage-initializer, controller, router and agent images
- Exact affected version ranges: Unknown.
Fixed in
Unknown. No fixed version has been confirmed. Check the Red Hat CVE page and the RHOAI errata for your release line.
Workaround
- Restrict who can create or update InferenceService objects, per namespace
- Review existing InferenceService resources for storageUri values pointing to unexpected hosts
- Restrict egress from model-serving namespaces with NetworkPolicies or an egress firewall, and block pod access to the cloud metadata endpoint
- Reduce the IAM permissions of node roles
Exploitation
- Not listed in the CISA KEV catalog.
- No public exploit code confirmed.
- Not known to be exploited, according to aggregators.
- CVSS 3.1 7.7 (High) per the Red Hat CNA; NVD status Awaiting Analysis; VulDB lists 4.3.
Our recommendation
- Identify any customer running RHOAI or KServe.
- Review RBAC for InferenceService create and update rights, and limit them to trusted users.
- Check node IAM role exposure and reduce permissions where possible.
- Monitor for unusual outbound requests from storage-initializer containers.
- Track the Red Hat advisory and apply the vendor errata once a fixed build is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-13451 access.redhat.com
- Red Hat Bugzilla 2493640 bugzilla.redhat.com
- Red Hat Security Data API (CVE) access.redhat.com
- KServe issue 6525 (upstream storageUri SSRF context) github.com
- VulDB CVE entry 427171 vuldb.com
- TheHackerWire CVE-2026-13451 (exploitation status) www.thehackerwire.com
- OffSeq Radar CVE-2026-13451 radar.offseq.com
- Red Hat KServe PR 4714 (related dependency update, unconfirmed) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 07:44.
Original description (NVD)
A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `storageUri`. This Server-Side Request Forgery (SSRF) vulnerability allows the `storage-initializer` init container to issue arbitrary outbound HTTP/HTTPS requests from inside the cluster. This can lead to information disclosure, including credential theft for the node's Identity and Access Management (IAM) role or access to internal cluster services.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.