Kubeflow Pipelines Unauthenticated SSRF & HTTP Smuggling (CVE-2026-5474) Analysis & POC

Vulnerability Overview Vulnerability Name: Unauthenticated SSRF and HTTP smuggling vulnerability in the route of Kubeflow Pipelines frontend, which can bypass . CVE ID: CVE-2026-5474 Severity: Critical (CVSS v3.1 Score 10.0/10) Affected Package: Affected Versions: ≤ 2.16.0 Fixed Version: 2.17.0 Scope of Impact Attack Vector: Network; Complexity: Low; No privileges required, no user interaction required. Affected URL prefixes (all are routable): - - - - Attackers can trigger routing via the header or any path carrying ; methods, request bodies, and headers are forwarded as-is, allowing exploitation via POST. Can be used for: - Initiating requests to internal services (e.g., IMDS at ) via the header to steal cloud credentials (AWS/Azure/GCP metadata). - Bypassing IP-based whitelists via the header. - Sending arbitrary POST bodies to internal endpoints via HTTP smuggling. Typical deployment scenarios: In standalone deployments, the frontend is exposed via ingress or acts as a pre-authentication gateway within the cluster network; in cloud-hosted Kubeflow deployments, IMDS is reachable. Remediation Upgrade to 2.17.0 or later. Interim mitigations: - Set to and properly configure authentication middleware to ensure the route is protected by authentication. - Restrict the source IPs for access to the route at the ingress/gateway layer. - If an immediate upgrade is not possible, the exposure of the route can be temporarily removed or restricted. POC / Exploit Code Terminal A (Frontend container startup) Terminal B (Minimal listener, recording incoming requests) Basic SSRF Exploitation with ENABLE_AUTHZ=true (carrying Authorization header) basePath variant and Referer trigger Link-local target (IMDS)

Goal Reached Thanks to every supporter — we hit 100%!

Kubeflow Pipelines Unauthenticated SSRF & HTTP Smuggling (CVE-2026-5474) Analysis & POC

More from this source