Summary
Kubeflow Model Registry contains a server-side request forgery vulnerability in its handling of the modelregistry.kubeflow.org/url annotation. A namespace user may cause an InferenceService to contact an attacker-controlled endpoint, exposing a controller ServiceAccount bearer token that could enable unauthorized modification of other tenants' InferenceServices.
Kubeflow Model Registry contains a server-side request forgery vulnerability in its handling of the modelregistry.kubeflow.org/url annotation. A namespace user may cause an InferenceService to contact an attacker-controlled endpoint, exposing a controller ServiceAccount bearer token that could enable unauthorized modification of other tenants' InferenceServices.
Affected context
The vulnerability can arise in Kubeflow Model Registry deployments where users are permitted to create or influence InferenceService resources and the controller processes the modelregistry.kubeflow.org/url annotation. Risk is increased when the controller can make outbound requests to user-controlled destinations and its ServiceAccount has permissions extending beyond the requesting namespace.
The vulnerability can arise in Kubeflow Model Registry deployments where users are permitted to create or influence InferenceService resources and the controller processes the modelregistry.kubeflow.org/url annotation. Risk is increased when the controller can make outbound requests to user-controlled destinations and its ServiceAccount has permissions extending beyond the requesting namespace.
Exploit preconditions
- Attack surface: Kubeflow Model Registry controller processing of InferenceService metadata
- Required access: Namespace-level permission to create or modify an InferenceService or an equivalent resource carrying the annotation
- Trigger point: Controller handling of the
modelregistry.kubeflow.org/urlannotation and making an outbound request - Why exploitation is possible: The controller may be induced to send its bearer token to an attacker-controlled endpoint, and excessive ServiceAccount permissions may then allow cross-tenant resource changes
- Attack surface: Kubeflow Model Registry controller processing of InferenceService metadata
- Required access: Namespace-level permission to create or modify an InferenceService or an equivalent resource carrying the annotation
- Trigger point: Controller handling of the
modelregistry.kubeflow.org/urlannotation and making an outbound request - Why exploitation is possible: The controller may be induced to send its bearer token to an attacker-controlled endpoint, and excessive ServiceAccount permissions may then allow cross-tenant resource changes
Why this happens
The underlying issue is server-side request forgery, mapped to CWE-918. A controller accepts a user-influenced URL and performs a server-side request without sufficiently restricting destinations or isolating sensitive request credentials. When privileged authentication material is available to the requesting component, an attacker-controlled destination may receive that material and use it against APIs accessible to the associated identity.
The underlying issue is server-side request forgery, mapped to CWE-918. A controller accepts a user-influenced URL and performs a server-side request without sufficiently restricting destinations or isolating sensitive request credentials. When privileged authentication material is available to the requesting component, an attacker-controlled destination may receive that material and use it against APIs accessible to the associated identity.
Potential impact
- An attacker could obtain a controller ServiceAccount bearer token
- Other tenants' InferenceServices may be modified without authorization
- Model-serving workloads or deployment configuration could be altered
- The compromised identity could enable broader cluster activity if its permissions are excessive
- Confidentiality and integrity of tenant-managed resources may be reduced
- An attacker could obtain a controller ServiceAccount bearer token
- Other tenants' InferenceServices may be modified without authorization
- Model-serving workloads or deployment configuration could be altered
- The compromised identity could enable broader cluster activity if its permissions are excessive
- Confidentiality and integrity of tenant-managed resources may be reduced
General mitigation guidance
Mitigation generally focuses on reducing user control over server-side request destinations and preventing credentials from crossing trust boundaries.
Common defensive patterns include:
- Allowlisting approved URL schemes, hosts, ports, and network destinations
- Separating metadata or model retrieval from privileged controller operations
- Never forwarding ServiceAccount tokens to user-controlled or untrusted endpoints
- Applying network egress controls that block access to cloud metadata services, control-plane endpoints, and private administrative networks
- Using dedicated ServiceAccounts with narrowly scoped, namespace-aware permissions
- Enforcing authorization and tenant-isolation checks for every resource mutation
- Treating annotation values as untrusted input and validating them before any network request
Mitigation generally focuses on reducing user control over server-side request destinations and preventing credentials from crossing trust boundaries.
Common defensive patterns include:
- Allowlisting approved URL schemes, hosts, ports, and network destinations
- Separating metadata or model retrieval from privileged controller operations
- Never forwarding ServiceAccount tokens to user-controlled or untrusted endpoints
- Applying network egress controls that block access to cloud metadata services, control-plane endpoints, and private administrative networks
- Using dedicated ServiceAccounts with narrowly scoped, namespace-aware permissions
- Enforcing authorization and tenant-isolation checks for every resource mutation
- Treating annotation values as untrusted input and validating them before any network request
How teams detect issues like this
Detection approaches can include:
- Static analysis and code review for HTTP clients that consume user-controlled URLs
- Searches for annotation, label, or specification fields flowing into outbound request destinations
- Review of code paths that attach authentication headers to dynamically selected endpoints
- Admission policies restricting URL annotations and approved destination domains
- Network monitoring for controller egress to unexpected external hosts, metadata endpoints, or tenant-controlled services
- Audit-log review for cross-namespace InferenceService modifications by controller identities
- Automated security review tools that flag SSRF data flows and excessive ServiceAccount permissions
Detection approaches can include:
- Static analysis and code review for HTTP clients that consume user-controlled URLs
- Searches for annotation, label, or specification fields flowing into outbound request destinations
- Review of code paths that attach authentication headers to dynamically selected endpoints
- Admission policies restricting URL annotations and approved destination domains
- Network monitoring for controller egress to unexpected external hosts, metadata endpoints, or tenant-controlled services
- Audit-log review for cross-namespace InferenceService modifications by controller identities
- Automated security review tools that flag SSRF data flows and excessive ServiceAccount permissions
