Bug 2550792 (CVE-2026-110220)

Summary: CVE-2026-110220 github.com/kubeflow/hub: Kubeflow Model Registry: Privilege escalation via Server-Side Request Forgery in InferenceService annotation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Kubeflow Model Registry. This Server-Side Request Forgery (SSRF) vulnerability allows an authenticated namespace user to provide an attacker-controlled address within an InferenceService resource annotation. When the controller processes the resource, it makes an outgoing request to the specified address and forwards its own service account authentication token. An attacker can capture this credential to escalate privileges and modify other tenants' workloads across the cluster.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-13 19:03:31 UTC 
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.