Description
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubeflow | Model Registry | ≤ 0.3.17 | — |
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding third-party-advisory
- https://github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.go#L268-L292 technical-description
- https://github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.go#L420-L423 technical-description
- https://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go#L224-L228 technical-description
- https://github.com/kubeflow/hub product
- VulnCheck Advisory: Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation third-party-advisory