Kubeflow Pipelines CVE-2026-54745

Exploitation requires only network reachability to the Kubeflow Pipelines frontend server; the /_proxy/ route is unauthenticated and remains outside the authorization middleware even when ENABLE_AUTHZ=true, so enabling authorization does NOT mitigate it. The attacker controls the target via the request path or a crafted Referer header on any of /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, or /pipeline/apis/v2beta1/_proxy/. Limiting factors: the attacker must be able to reach the frontend server's network endpoint, and the practical impact depends on what internal services are reachable from the frontend pod (e.g. an accessible cloud metadata endpoint or Kubernetes API); egress network restrictions or IMDSv2 on the pod materially constrain what can be exfiltrated. Affected versions are all releases prior to 2.17.0.

All available signals point to genuine critical risk rather than an inflated CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and a scope change because the frontend server is abused to pivot into a different security authority (internal cluster/cloud services). The confidentiality and integrity impacts are well supported - the proxy forwards attacker-chosen methods and Authorization/Cookie headers and returns upstream responses, enabling both reading (metadata credentials) and modifying (service/K8s API calls) internal resources; availability impact is plausible via destructive API calls though slightly less direct than C/I. No EPSS score, KEV entry, or public PoC was provided, so exploitation is not confirmed in the wild; however the vulnerability class (unauthenticated SSRF to cloud metadata) is a well-understood, commonly weaponized pattern, so absence of a published PoC should not lower urgency. Net: treat as a top-priority patch, especially for internet-exposed or multi-tenant clusters.

An attacker who can reach the Kubeflow Pipelines UI sends an unauthenticated request to /apis/v1beta1/_proxy/ (or supplies a crafted Referer header) pointing at http://169.254.169.254/latest/meta-data/iam/security-credentials/, and the frontend server proxies the request and returns cloud IAM credentials in the response. The same primitive can be aimed at the in-cluster Kubernetes API or other internal services with attacker-chosen methods and headers to read or modify resources. No PoC is published, but the AV:N/AC:L/PR:N/UI:N profile means exploitation requires only crafted HTTP requests and no authentication.