CVE-2026-54745

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54745", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T23:12:41.964Z", "datePublished": "2026-08-28T15:59:01.118Z", "dateUpdated": "2026-08-31T19:10:06.738Z"}, "containers": {"cna": {"title": "Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7"}, {"name": "https://github.com/kubeflow/pipelines/pull/13511", "tags": ["x_refsource_MISC"], "url": "https://github.com/kubeflow/pipelines/pull/13511"}, {"name": "https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd", "tags": ["x_refsource_MISC"], "url": "https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd"}, {"name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"}], "affected": [{"vendor": "kubeflow", "product": "pipelines", "versions": [{"version": "< 2.17.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-28T15:59:01.118Z"}, "descriptions": [{"lang": "en", "value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route remains outside the authorization middleware when ENABLE_AUTHZ=true and is reachable through /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, and /pipeline/apis/v2beta1/_proxy/, including through a crafted Referer header. Requests can forward attacker-controlled methods, headers such as Authorization, Cookie, and X-Forwarded-For, and POST bodies to reachable internal services, while returning the upstream response to the unauthenticated client. This can expose cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification. This issue is fixed in version 2.17.0."}], "source": {"advisory": "GHSA-gqww-5pj5-8fq7", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T19:09:39.730504Z", "id": "CVE-2026-54745", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T19:10:06.738Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54745", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-31T19:09:39.730504Z"}}}], "references": [{"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T19:09:58.539Z"}}], "cna": {"title": "Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true", "source": {"advisory": "GHSA-gqww-5pj5-8fq7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kubeflow", "product": "pipelines", "versions": [{"status": "affected", "version": "< 2.17.0"}]}], "references": [{"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7", "name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kubeflow/pipelines/pull/13511", "name": "https://github.com/kubeflow/pipelines/pull/13511", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd", "name": "https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0", "name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route remains outside the authorization middleware when ENABLE_AUTHZ=true and is reachable through /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, and /pipeline/apis/v2beta1/_proxy/, including through a crafted Referer header. Requests can forward attacker-controlled methods, headers such as Authorization, Cookie, and X-Forwarded-For, and POST bodies to reachable internal services, while returning the upstream response to the unauthenticated client. This can expose cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification. This issue is fixed in version 2.17.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-28T15:59:01.118Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54745", "state": "PUBLISHED", "dateUpdated": "2026-08-31T19:10:06.738Z", "dateReserved": "2026-06-15T23:12:41.964Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-28T15:59:01.118Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pipelines", "vendor": "kubeflow", "versions": [{"status": "affected", "version": "< 2.17.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route remains outside the authorization middleware when ENABLE_AUTHZ=true and is reachable through /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, and /pipeline/apis/v2beta1/_proxy/, including through a crafted Referer header. Requests can forward attacker-controlled methods, headers such as Authorization, Cookie, and X-Forwarded-For, and POST bodies to reachable internal services, while returning the upstream response to the unauthenticated client. This can expose cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification. This issue is fixed in version 2.17.0."}], "id": "CVE-2026-54745", "lastModified": "2026-09-09T21:09:13.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54745", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-31T19:09:39.730504Z", "version": "2.0.3"}}]}, "published": "2026-08-28T20:18:17.240", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd"}, {"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/pull/13511"}, {"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "kubeflow/pipelines: pipelines: Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true", "id": "2525724", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525724"}, "csaw": false, "cvss3": {"cvss3_base_score": "10.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Kubeflow Pipelines. An unauthenticated attacker can exploit a Server-Side Request Forgery (SSRF) and HTTP smuggling vulnerability through the `/_proxy/` route. This allows the attacker to bypass authorization and forward arbitrary requests to internal services. Consequently, this can expose sensitive cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, restrict network access to the Kubeflow Pipelines frontend to trusted internal networks. Implement firewall rules or network access control lists to prevent external or untrusted access to the ports exposed by the Kubeflow Pipelines service. This action reduces the attack surface by ensuring that only authorized internal systems can reach the vulnerable `/_proxy/` route, thereby limiting the potential for unauthenticated Server-Side Request Forgery and HTTP smuggling attacks. This mitigation may impact legitimate external users who require access to the Kubeflow Pipelines frontend."}, "name": "CVE-2026-54745", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-api-server-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-driver-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-launcher-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-08-28T15:59:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54745\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54745\nhttps://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd\nhttps://github.com/kubeflow/pipelines/pull/13511\nhttps://github.com/kubeflow/pipelines/releases/tag/2.17.0\nhttps://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7"], "statement": "This Critical vulnerability in Kubeflow Pipelines allows unauthenticated attackers to exploit a Server-Side Request Forgery (SSRF) and HTTP smuggling flaw via the /_proxy/ route. This bypasses authorization, enabling access to internal cluster services and potentially exposing sensitive cloud metadata credentials, Kubernetes APIs, or other internal endpoints for unauthorized data exfiltration or modification. The unauthenticated nature and broad impact on internal services elevate the risk in exposed deployments.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.17.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pipelines", "source": "cna", "vendor": "kubeflow"}, "product": "pipelines", "vendor": "kubeflow"}], "created": "2026-08-28T21:15:03.454819+00:00", "updated": "2026-08-28T22:15:04.150986+00:00", "vendors": ["kubeflow", "kubeflow$PRODUCT$pipelines"]}