Summary
Kubeflow Pipelines' artifact-download and archived pod-log paths can use S3-compatible endpoint metadata that is not required to match operator-controlled storage settings. In the authorization-disabled standalone configuration, an unauthenticated caller may cause the shared UI pod to contact arbitrary reachable hosts and return response data.
Kubeflow Pipelines' artifact-download and archived pod-log paths can use S3-compatible endpoint metadata that is not required to match operator-controlled storage settings. In the authorization-disabled standalone configuration, an unauthenticated caller may cause the shared UI pod to contact arbitrary reachable hosts and return response data.
Affected context
The issue concerns Kubeflow Pipelines frontend paths for downloading artifacts from S3 or MinIO and retrieving archived pod logs. Risk arises when endpoint metadata supplied through artifact provider information or workflow status is used without being bound to operator-controlled storage configuration. The described unauthenticated exposure applies to the shipped authorization-disabled standalone configuration; multi-user secret-backed metadata remains restricted to the server namespace.
The issue concerns Kubeflow Pipelines frontend paths for downloading artifacts from S3 or MinIO and retrieving archived pod logs. Risk arises when endpoint metadata supplied through artifact provider information or workflow status is used without being bound to operator-controlled storage configuration. The described unauthenticated exposure applies to the shipped authorization-disabled standalone configuration; multi-user secret-backed metadata remains restricted to the server namespace.
Exploit preconditions
- Attack surface: Artifact-download or archived pod-log functionality that processes S3-compatible endpoint metadata
- Required access: In the shipped authorization-disabled standalone configuration, no authentication is required; other deployments may impose access controls
- Trigger point: A request causes the frontend to use an endpoint from artifact provider information or workflow status
- Network condition: The shared
ml-pipeline-uipod must be able to reach the specified host - Why exploitation is possible: The supplied endpoint is not required to match operator-controlled storage configuration, allowing the pod to make requests to attacker-influenced destinations
- Attack surface: Artifact-download or archived pod-log functionality that processes S3-compatible endpoint metadata
- Required access: In the shipped authorization-disabled standalone configuration, no authentication is required; other deployments may impose access controls
- Trigger point: A request causes the frontend to use an endpoint from artifact provider information or workflow status
- Network condition: The shared
ml-pipeline-uipod must be able to reach the specified host - Why exploitation is possible: The supplied endpoint is not required to match operator-controlled storage configuration, allowing the pod to make requests to attacker-influenced destinations
Why this happens
The application uses endpoint metadata from artifact or workflow data to make server-side requests without sufficiently constraining it to trusted, operator-configured storage endpoints. This is a server-side request forgery weakness (CWE-918): the server acts as a network client using a destination that is not adequately trusted or validated. When configured object-store credentials are used to sign a request, the access-key identifier may also be exposed in the resulting interaction.
The application uses endpoint metadata from artifact or workflow data to make server-side requests without sufficiently constraining it to trusted, operator-configured storage endpoints. This is a server-side request forgery weakness (CWE-918): the server acts as a network client using a destination that is not adequately trusted or validated. When configured object-store credentials are used to sign a request, the access-key identifier may also be exposed in the resulting interaction.
Potential impact
- The UI pod may connect to arbitrary hosts that are reachable from its network
- Responses from reachable services may be returned to the caller
- Internal services or data may be exposed, depending on network access and response handling
- An access-key identifier may be revealed when a request is signed with configured object-store credentials
- The UI pod may connect to arbitrary hosts that are reachable from its network
- Responses from reachable services may be returned to the caller
- Internal services or data may be exposed, depending on network access and response handling
- An access-key identifier may be revealed when a request is signed with configured object-store credentials
General mitigation guidance
Defensive patterns focus on ensuring server-side requests can only reach trusted storage destinations.
- Derive endpoints from operator-controlled configuration rather than caller-influenced metadata
- Where endpoint metadata is necessary, validate it against an explicit allowlist and reject mismatches
- Require authentication and authorization for artifact and log retrieval paths
- Avoid using privileged object-store credentials for requests to untrusted destinations
- Apply restrictive network egress controls and least-privilege access for the UI pod
- Keep multi-user metadata access scoped to the intended server namespace
Defensive patterns focus on ensuring server-side requests can only reach trusted storage destinations.
- Derive endpoints from operator-controlled configuration rather than caller-influenced metadata
- Where endpoint metadata is necessary, validate it against an explicit allowlist and reject mismatches
- Require authentication and authorization for artifact and log retrieval paths
- Avoid using privileged object-store credentials for requests to untrusted destinations
- Apply restrictive network egress controls and least-privilege access for the UI pod
- Keep multi-user metadata access scoped to the intended server namespace
How teams detect issues like this
- Review code paths that construct outbound requests from artifact metadata, workflow status, or other user-influenced values
- Use static analysis to flag server-side HTTP clients whose destinations originate from request or persisted workflow data
- Check whether endpoint validation binds values to operator-controlled configuration and rejects unexpected schemes, hosts, and ports
- Monitor egress from the UI pod for connections to destinations outside approved storage services
- Enforce network policies that limit pod egress to required endpoints, and audit authorization settings for standalone deployments
- Review code paths that construct outbound requests from artifact metadata, workflow status, or other user-influenced values
- Use static analysis to flag server-side HTTP clients whose destinations originate from request or persisted workflow data
- Check whether endpoint validation binds values to operator-controlled configuration and rejects unexpected schemes, hosts, and ports
- Monitor egress from the UI pod for connections to destinations outside approved storage services
- Enforce network policies that limit pod egress to required endpoints, and audit authorization settings for standalone deployments
