Description

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials. Multi-user secret-backed metadata remains restricted to the server namespace. This issue is fixed in version 2.18.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-11-05T23:17:01.433Z",
  "pubdate": "2026-11-05T23:17:01.433Z",
  "executiveSummary": "Kubeflow Pipelines prior to version 2.18.0 contains a Server-Side Request Forgery (SSRF) vulnerability within its frontend artifact and log retrieval mechanisms.\nThe vulnerability originates from the application's failure to validate user-supplied endpoint parameters against authorized, operator-defined object storage configurations.\nIn environments where authorization is disabled, such as the default standalone configuration, an unauthenticated attacker can force the ml-pipeline-ui pod to initiate outbound requests to arbitrary network destinations.\nThe primary impact includes unauthorized data exfiltration via the server's network context, potential discovery of internal network topology, and the inadvertent exposure of sensitive access-key identifiers through authenticated requests to malicious endpoints.\nThis flaw effectively allows an external actor to leverage the identity and network position of the pipeline UI pod to interact with internal or external services.\nUsers are at risk if their deployment allows unauthorized access to the pipeline interface, as the lack of strict endpoint validation provides an oracle for probing and data theft.",
  "technicalDetails": "The vulnerability exists in the handling of artifact download paths and archived pod-log paths within the ml-pipeline-ui component of Kubeflow Pipelines. Specifically, the system processes 'providerInfo.Params.endpoint' for S3 or MinIO sources and processes S3-compatible endpoint metadata derived from workflow status without verifying these endpoints against an allowlist of sanctioned storage backends.\nThe root cause is an improper trust assumption where the application blindly consumes user-supplied or workflow-supplied metadata to construct requests for external storage providers. Because the application logic fails to perform origin validation or endpoint sanitization, it becomes susceptible to an SSRF attack vector.\nIn the default authorization-disabled standalone installation, an attacker can craft requests directed at the ml-pipeline-ui service. By manipulating the 'source' parameter or providing specific workflow metadata containing a malicious 'endpoint', the attacker instructs the pod to perform an HTTP request or S3-compatible API call to a URI of their choosing.\nThe attack flow proceeds as follows: First, the attacker identifies a target host or internal service reachable by the ml-pipeline-ui pod. Second, the attacker submits an artifact download request or interacts with a log-viewing endpoint, injecting a malicious URL or IP into the 'providerInfo.Params.endpoint' field. Third, the backend service interprets this input and initiates a connection to the specified endpoint. Fourth, if the attacker chooses a legitimate S3-compatible service, they can force the application to include its configured access-key identifier in the authorization header of the resulting request, thereby leaking credentials to the attacker-controlled server. Finally, the application returns the response data (or error messages containing metadata) from the attacker-defined host back to the client.\nThis vulnerability is particularly critical because it bypasses architectural boundaries intended to isolate storage interactions. While multi-user secret-backed metadata is constrained to the server namespace, the SSRF primitive grants the attacker the capability to interact with internal network assets, potentially leading to unauthorized information disclosure or further exploitation of infrastructure services within the cluster's network namespace."
}