CVE-2026-54745: Kubeflow Pipelines SSRF Vulnerability

CVE-2026-54745 Overview

CVE-2026-54745 is an unauthenticated server-side request forgery (SSRF) vulnerability in the Kubeflow Pipelines frontend. The flaw exists in frontend/server/proxy-middleware.ts and allows arbitrary attackers to relay HTTP and HTTPS requests through the /_proxy/ route. The _routePathWithReferer() function accepts attacker-controlled targets without validating the destination host. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, unauthenticated clients can reach cloud metadata endpoints, Kubernetes APIs, and cluster-internal services. Kubeflow Pipelines versions prior to 2.17.0 are affected.

Critical Impact
Unauthenticated attackers can pivot into cluster-internal networks, steal cloud instance metadata credentials, and read or modify Kubernetes and service APIs through the exposed proxy route.

Affected Products

Kubeflow Pipelines versions prior to 2.17.0
Deployments exposing the frontend server through /apis/v1beta1/_proxy/ or /apis/v2beta1/_proxy/
Deployments exposing the frontend server through /pipeline/apis/v1beta1/_proxy/ or /pipeline/apis/v2beta1/_proxy/

Discovery Timeline

2026-08-28 - CVE-2026-54745 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-54745

Vulnerability Analysis

The Kubeflow Pipelines frontend server registers a proxy route at /_proxy/ that forwards requests to arbitrary upstream URLs. The _routePathWithReferer() helper reads either the request path or a Referer header, extracts the target URL, and passes its origin to createProxyMiddleware. No allowlist restricts destinations, and the code does not filter loopback, link-local, RFC1918, or cluster-local addresses. Attackers can therefore direct the proxy at 169.254.169.254, in-cluster services, or the Kubernetes API server.

The proxy forwards attacker-supplied HTTP methods, headers such as Authorization, Cookie, and X-Forwarded-For, and arbitrary POST bodies. The upstream response is returned to the caller, turning the frontend into a fully bidirectional SSRF relay. This maps to [CWE-284: Improper Access Control].

Root Cause

The route is registered outside the authorization middleware chain. Even when operators set ENABLE_AUTHZ=true, requests to /_proxy/ and its API-prefixed variants bypass authentication and authorization checks. The absence of destination filtering compounds the exposure by permitting requests to sensitive internal endpoints.

Attack Vector

An unauthenticated network attacker sends a request to a vulnerable endpoint such as /apis/v1beta1/_proxy/http://169.254.169.254/latest/meta-data/. Alternatively, the attacker supplies a crafted Referer header containing the target URL. The frontend then relays the request and returns the response, exposing IAM credentials, service tokens, or cluster state.

typescript

// Removed by the 2.17.0 patch: frontend/mock-backend/proxy-middleware.ts
// The vulnerable helper accepted an attacker-controlled origin.
export function _routePathWithReferer(proxyPrefix: string, path: string, referer = ''): string {
  // If a referer header is included, extract the referer URL, otherwise
  // just trim out the /_proxy/ prefix. Use the origin of the resulting URL.
  // ...no host allowlist, no loopback/RFC1918 filtering...
}

Source: Kubeflow Pipelines commit a35f97a

Detection Methods for CVE-2026-54745

Indicators of Compromise

Access log entries containing /_proxy/ under /apis/v1beta1/, /apis/v2beta1/, /pipeline/apis/v1beta1/, or /pipeline/apis/v2beta1/
Outbound requests from Kubeflow Pipelines frontend pods to 169.254.169.254, 127.0.0.1, or RFC1918 addresses that were not previously observed
Unusual Referer headers on frontend requests containing full HTTP or HTTPS URLs pointing at internal hosts
Upstream responses containing IAM credential JSON structures returned through the frontend

Detection Strategies

Inspect ingress and reverse-proxy logs for any request path matching _proxy/https?:// and alert on unauthenticated sources
Correlate frontend pod egress traffic with cloud metadata IPs and Kubernetes API server addresses
Build a rule that flags responses to /_proxy/ requests containing AccessKeyId, SecretAccessKey, or Bearer tokens

Monitoring Recommendations

Enable Kubernetes audit logging and watch for API calls originating from the Kubeflow Pipelines frontend service account
Monitor cloud provider metadata service access patterns from workload pods
Track version drift of the Kubeflow Pipelines frontend image across clusters to confirm remediation status

How to Mitigate CVE-2026-54745

Immediate Actions Required

Upgrade Kubeflow Pipelines to version 2.17.0 or later, which removes the vulnerable proxy middleware and hardens TensorBoard proxy access
Restrict network access to the Kubeflow Pipelines frontend using NetworkPolicies until the upgrade is complete
Rotate any credentials that may have been exposed through cloud metadata or Kubernetes service accounts reachable from the frontend pod

Patch Information

The fix ships in Kubeflow Pipelines release 2.17.0 via pull request #13511 and commit a35f97aa4c17b25572369e5022546ab4421bdbdd. The patch removes proxy-middleware.ts and replaces the generic proxy with a hardened TensorBoard-specific proxy registration. See the GHSA-gqww-5pj5-8fq7 advisory for full details.

Workarounds

Block requests matching /_proxy/ at an ingress controller or web application firewall if immediate upgrade is not possible
Apply a Kubernetes NetworkPolicy that denies egress from the frontend pod to 169.254.0.0/16, 127.0.0.0/8, and RFC1918 ranges except approved backends
Disable the frontend deployment in clusters that do not require the Pipelines UI until patched images are rolled out

bash

# Example NetworkPolicy restricting frontend egress to the metadata IP
kubectl apply -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: kfp-frontend-egress-restrict
  namespace: kubeflow
spec:
  podSelector:
    matchLabels:
      app: ml-pipeline-ui
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32
              - 127.0.0.1/32
EOF