Critical [CVE-2026-54745] Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true
This critical-severity Red Hat Linux advisory covers CVE-2026-54745.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in Kubeflow Pipelines. An unauthenticated attacker can exploit a Server-Side Request Forgery (SSRF) and HTTP smuggling vulnerability through the `/_proxy/` route.
This allows the attacker to bypass authorization and forward arbitrary requests to internal services. Consequently, this can expose sensitive cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification.
The unauthenticated nature and broad impact on internal services elevate the risk in exposed deployments. Red Hat severity: Important — CVSS 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Weakness: CWE-918. Under investigation: Red Hat OpenShift AI (RHOAI).
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- To mitigate this vulnerability, restrict network access to the Kubeflow Pipelines frontend to trusted internal networks. Implement firewall rules or network access control lists to prevent external or untrusted access to the ports exposed by the Kubeflow Pipelines service. This action reduces the attack surface by ensuring that only authorized internal systems can reach the vulnerable `/_proxy/` route, thereby limiting the potential for unauthenticated Server-Side Request Forgery and HTTP smuggling attacks. This mitigation may impact legitimate external users who require access to the Kubeflow Pipelines frontend.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.