CVE-2026-54745

Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.17.0

Description The frontend exposes an unauthenticated server-side request forgery (SSRF) issue. The routePathWithReferer() function accepts an arbitrary HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. This allows unauthenticated clients to forward methods, POST bodies, and headers such as Authorization, Cookie, and X-Forwarded-For to internal services. This can lead to the exposure of cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints for unauthorized read or modification. The issue is reachable through the following endpoints:

Recommendations Update to version 2.17.0.