KServe CVE-2026-13451

Exploitation requires an authenticated principal with namespace-scoped create or update permissions on KServe InferenceService custom resources; with that RBAC the attacker sets a crafted storageUri that the storage-initializer init container fetches, producing arbitrary outbound HTTP/HTTPS requests from inside the cluster. The limiting factors are concrete: the attacker must already possess those specific InferenceService RBAC rights (PR:L, so not remote-unauthenticated), and impact depends on what the cluster network path exposes - reachability of the cloud instance-metadata/IAM endpoint or internal-only services determines whether credential theft or internal-service access is achievable. No special non-default product feature toggle is named in the sources; the prerequisite is the RBAC permission plus a reachable internal target.

This is a genuine but access-gated risk, not a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 HIGH) tells a consistent story: network-reachable and low-complexity, but it requires PR:L - a namespace-scoped user already holding create/update RBAC on InferenceService custom resources - which materially shrinks the attacker population to insiders or anyone who has already gained a foothold with those Kubernetes permissions. The scope change (S:C) is the aggravating factor and is well-justified: the SSRF lets the storage-initializer init container reach beyond KServe into the cloud metadata service and internal cluster services, with C:H driven by theft of the node's IAM-role credentials. The vuln.today Decision label is 'this_week' (not act_now/emergency), which aligns with the picture of a serious authenticated flaw rather than an unauthenticated internet-facing one. EPSS is not provided in the input, so exploitation probability cannot be quantified here. KEV status is not listed (no CISA KEV entry supplied) and no PoC or exploit reference appears in the data, so there is no evidence of active exploitation or public exploit code. Net: prioritize for patching within the normal urgency window indicated, treating it as a privilege-escalation/lateral-movement enabler for an already-authenticated tenant rather than a wormable perimeter bug.

A malicious or compromised tenant who holds create/update rights on InferenceService resources in their namespace submits an InferenceService whose storageUri points at an internal target (for example the cloud instance-metadata endpoint). When KServe spins up the storage-initializer init container, it issues the attacker-chosen outbound HTTP/HTTPS request from inside the cluster and returns or exposes sensitive responses such as the node's IAM-role credentials or internal service data. No public exploit code is referenced in the available sources.