Vulnerability in Kubeflow Model Registry

[ Description ]Official description

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/kubeflow/hub
• github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go
• github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.go
• github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.go
• hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding
• www.vulncheck.com/advisories/kubeflow-model-registry-through-0.3.17-ssrf-via-inferences…