CVE-2026-110220: Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

Awaiting analysis

Published 13-10-2026Last modified 26-10-2026

Vulnerability summary

CVE-2026-110220 is a high (CVSS 7.1) Server-Side Request Forgery vulnerability in kubeflow model registry. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.1/10

010

High · v4.0 (CVE.org)

EPSS score

0.35%

0%100%

Low · Change unavailable

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

13-10-2026
PublishedVulnerability first disclosed.
26-10-2026
Last modifiedVulnerability information updated.

Description

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.

CVSS metrics

4 scores · 2 sources · 2 versions

v4.07.1v3.17.1

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

28%

Versus all other CVEs

30-day change

Change unavailable

14-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Kubeflow1 product

model registry≤ 0.3.17

1 vendor · 1 product

References

6 links

hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwardingThird Party Advisory
github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.goTechnical Description
github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.goTechnical Description
github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.goTechnical Description
github.com/kubeflow/hubProduct
www.vulncheck.com/advisories/…Third Party Advisory