CVE-2026-110220: Kubeflow Model Registry SSRF Vulnerability

CVE-2026-110220 Overview

CVE-2026-110220 is a server-side request forgery (SSRF) vulnerability [CWE-918] in Kubeflow Model Registry versions through 0.3.17. The flaw resides in the InferenceService controller, which blindly follows a user-controlled URL defined in the modelregistry.kubeflow.org/url annotation. Namespace tenants can point the annotation at an attacker-controlled server and capture the controller's ServiceAccount bearer token. With that token, an attacker can read and modify InferenceService resources belonging to other tenants cluster-wide, breaking Kubernetes multi-tenant isolation.

Critical Impact
Any authenticated namespace user can exfiltrate the Model Registry controller ServiceAccount token and manipulate InferenceServices across every tenant namespace.

Affected Products

Kubeflow Model Registry versions up to and including 0.3.17
Kubernetes clusters running the Model Registry inferenceservice-controller
Multi-tenant Kubeflow deployments relying on namespace isolation

Discovery Timeline

2026-10-13 - CVE-2026-110220 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-110220

Vulnerability Analysis

The Kubeflow Model Registry controller watches InferenceService objects across namespaces and reconciles them against the Model Registry service. During reconciliation, the controller reads the modelregistry.kubeflow.org/url annotation set by the tenant and issues an authenticated HTTP request to that URL using the controller's own ServiceAccount token as a bearer credential.

Because the URL is tenant-supplied and no allow-list or hostname validation is enforced, an attacker can direct the request to a server they control. The outbound request carries the controller's privileged token in the Authorization header, where the attacker captures it in plaintext.

The controller ServiceAccount holds cluster-wide permissions to list and modify InferenceService objects. Once stolen, the token enables cross-tenant tampering, including redirecting model serving traffic and altering inference configurations in other namespaces.

Root Cause

The root cause is missing validation of a user-controlled destination URL combined with unconditional forwarding of a privileged bearer token. The controller treats the annotation as trusted controller configuration rather than tenant-supplied input, violating the SSRF guidance in [CWE-918].

Attack Vector

An attacker with permission to create or edit an InferenceService in any watched namespace sets the modelregistry.kubeflow.org/url annotation to a URL hosted on infrastructure they control. The controller reconciles the resource, resolves the URL, and sends an authenticated request. The attacker logs the inbound Authorization: Bearer <token> header and reuses the token against the Kubernetes API to enumerate and modify InferenceService objects in other tenants. Review the controller reconciliation flow in the Kubeflow Hub Inference Service Controller Code and the OpenAPI client token handling in the Kubeflow Hub OpenAPI Client Code.

Detection Methods for CVE-2026-110220

Indicators of Compromise

InferenceService resources containing a modelregistry.kubeflow.org/url annotation that resolves to an external, non-registry hostname or raw IP address.
Egress HTTP/HTTPS traffic from the Model Registry controller pod to destinations outside the cluster's Model Registry service endpoints.
Kubernetes audit log entries showing InferenceService mutations in namespaces the editing identity does not own, performed using the controller ServiceAccount token.

Detection Strategies

Inspect all InferenceService manifests cluster-wide and alert on annotation values that do not match the approved internal Model Registry service DNS name.
Enable Kubernetes API server audit logging and flag update/patch operations on InferenceService objects where the subject is the controller ServiceAccount but the request pattern deviates from normal reconciliation.
Monitor controller pod egress using a service mesh or network policy telemetry to detect requests to untrusted destinations.

Monitoring Recommendations

Track outbound requests from the inferenceservice-controller pod and alert on new destination hostnames or IPs.
Correlate annotation changes on InferenceService resources with subsequent controller egress events.
Review ServiceAccount token usage anomalies, including unexpected source IPs or user agents authenticating to the API server.

How to Mitigate CVE-2026-110220

Immediate Actions Required

Upgrade Kubeflow Model Registry to a version later than 0.3.17 once a fixed release is published by the maintainers.
Rotate the Model Registry controller ServiceAccount token and any credentials that may have been exposed through the annotation.
Audit existing InferenceService resources for suspicious modelregistry.kubeflow.org/url annotation values and remove untrusted entries.

Patch Information

At the time of publication, consult the VulnCheck Kubeflow SSRF Advisory and the Kubeflow Hub Repository for the latest fixed version and remediation guidance. Additional implementation context is available in the HackMD Kubeflow Hub Token Forwarding write-up.

Workarounds

Apply an admission policy (OPA Gatekeeper, Kyverno, or ValidatingAdmissionPolicy) that rejects InferenceService objects whose modelregistry.kubeflow.org/url annotation does not match the internal Model Registry service hostname.
Enforce a NetworkPolicy on the Model Registry controller namespace that restricts egress to the Model Registry service endpoint only, blocking requests to arbitrary external destinations.
Restrict RBAC permissions for creating or modifying InferenceService resources to trusted service owners while remediation is in progress.

bash

# Example Kyverno policy fragment restricting the SSRF-prone annotation
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-modelregistry-url
spec:
  validationFailureAction: Enforce
  rules:
    - name: validate-modelregistry-url
      match:
        any:
          - resources:
              kinds:
                - InferenceService
      validate:
        message: "modelregistry.kubeflow.org/url must reference the internal Model Registry service"
        pattern:
          metadata:
            annotations:
              modelregistry.kubeflow.org/url: "https://model-registry.kubeflow.svc.cluster.local*"