Search: CVE-2026-54745

Kubeflow Pipelines versions prior to 2.17.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the frontend proxy middleware. This flaw allows attackers to send arbitrary HTTP or HTTPS requests to internal services without authentication, bypassing authorization controls. The vulnerability arises because the proxy route does not filter or restrict target addresses and remains accessible even when authorization is enabled. Exploitation can lead to unauthorized access to sensitive internal endpoints, including cloud metadata services and Kubernetes APIs. The issue is fixed in version 2.17.0.