Threats tagged 'ghsa-f7vj-6669-qvv4'

The Kubeflow Pipelines API server allowed fetching pipeline package URLs supplied by callers without validating the destination host. This enabled authorized users to trigger requests from the API server's network position, potentially accessing internal services otherwise unreachable. The vulnerability is a server-side request forgery (SSRF) with limited information disclosure via status codes but no demonstrated arbitrary data or credential theft. The issue was fixed in version 0.0.0-20260517162502-504d7797c1e0 by enforcing strict URL validation and network restrictions.