External risk intelligence

Kubeflow Pipelines Unauthenticated Server-Side Request Forgery Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-54745

Kubeflow Pipelines is a web-based platform for machine learning workflows that is commonly deployed as an internet-facing application. The vulnerability resides in a frontend proxy route that is accessible without authentication, making it a reachable target for external actors when the platform is exposed to the internet.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Kubeflow Pipelines, a system for managing machine learning workflows, that could allow unauthorized access to sensitive internal services and credentials. This issue stems from an unauthenticated server-side request forgery vulnerability in the frontend's proxy route.

Unauthenticated access to internal services.
Potential exposure of sensitive credentials and APIs.
Confirm relevance and exposure to internal systems.

Attack Path

How an attacker could exploit the issue

An attacker can target an unauthenticated proxy route in the Kubeflow Pipelines frontend. By sending a specially crafted request, potentially including a malicious `Referer` header, an attacker can trick the proxy into forwarding requests to internal services. This allows them to access sensitive information or interact with internal APIs that should not be exposed.

No authentication is required.
Exploits a proxy route with controlled target.
Risks exposing internal services and credentials.

Live Threat

Current exploitation, exposure, and threat context

Under certain conditions, an unauthenticated attacker could exploit this vulnerability to make requests to internal services, potentially exposing sensitive information. This could include cloud metadata credentials, Kubernetes or service APIs, and other internal endpoints, allowing for unauthorized read or modification.

Internal service credentials and APIs.
Unauthenticated proxy route to internal services.
Unauthorized read or modification of data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Kubeflow Pipelines, a platform for machine learning workflows. Real-world ownership typically falls to the platform or application team responsible for Kubeflow, with potential involvement from network and security teams for exposure and ingress. The first practical step is to identify all Kubeflow Pipelines instances, confirm their reachability and criticality, and locate the accountable owner to prioritize remediation.

Platform/Application team ownership.
Verify internal reachability and business criticality.
Plan risk-based remediation and coordinate updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Kubeflow Pipelines?

Kubeflow Pipelines is a specialized platform used by data science and engineering teams to orchestrate and automate machine learning workflows. It provides a user interface and underlying infrastructure for building, deploying, and managing complex, scalable models. Because it manages the full lifecycle of these pipelines, it often acts as a central hub that interacts with various cloud resources and Kubernetes cluster services.

What is the Server-Side Request Forgery vulnerability in CVE-2026-54745?

This vulnerability is classified as CWE-918, Server-Side Request Forgery (SSRF). In simple terms, it means the software's proxy feature can be tricked into making requests to destinations it shouldn't be allowed to reach. Instead of only connecting to authorized external sites, the component can be manipulated to send requests to sensitive internal services, Kubernetes APIs, or cloud metadata endpoints that are normally hidden from the public internet.

How does an attacker trigger this issue?

An attacker triggers the vulnerability by sending a specifically crafted HTTP request to the /_proxy/ route of the Kubeflow Pipelines frontend. Because the application fails to validate the requested target—and lacks an allowlist for safe destinations—it blindly forwards the request. Importantly, this bypass occurs even if the system has authentication enabled, as the proxy route is specifically configured to exist outside the platform's standard authorization middleware.

Do I need to worry if my Kubeflow Pipelines instance is internal?

Halo Surface Signal indicates that Kubeflow Pipelines is commonly deployed as an internet-facing application, making it a highly reachable target for external actors. If your instance is truly isolated from the internet, the risk is lower, but you should still evaluate whether internal users or compromised local systems could reach the vulnerable proxy route. If the service is accessible over the internet, it should be considered a high-priority concern.

How do I start addressing CVE-2026-54745?

The most effective first step is to locate all deployed instances of Kubeflow Pipelines across your environment to understand your total footprint. Once identified, confirm the specific version in use; if you are running anything prior to 2.17.0, you are affected. Coordinate with your platform or application engineering teams to prioritize updating to version 2.17.0 or later, which resolves the flaw by properly securing the proxy functionality.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.