CVE-2026-110220: Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A namespace user who can create an InferenceService can exploit the issue. The attacker does not need user interaction and can direct the affected annotation to a server they control.
What access could an attacker gain after exploitation?
The attacker can capture the InferenceService controller ServiceAccount bearer token. The provided information states that this token can be used to modify other tenants' InferenceServices across the cluster.
How can I determine whether an environment may have been targeted?
Review InferenceService resources for the modelregistry.kubeflow.org/url annotation, particularly values that point to external or attacker-controlled servers. Investigate controller activity and outbound requests associated with those annotated resources for possible token forwarding.