CVE-2026-54745

Kubeflow Pipelines versions prior to 2.17.0 expose an unauthenticated server-side request forgery (SSRF) in the frontend's /_proxy/ route (frontend/server/proxy-middleware.ts), where the _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes it to createProxyMiddleware with no host allowlist and no filtering of loopback, link-local, RFC1918, or cluster-local addresses. An unauthenticated attacker triggers it by sending requests to the proxy endpoints — /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, or /pipeline/apis/v2beta1/_proxy/ — including via a crafted Referer header, and can control the forwarded HTTP method, headers (such as Authorization, Cookie, and X-Forwarded-For), and POST body, with the upstream response returned to the attacker. The route sits outside the authorization middleware even when ENABLE_AUTHZ=true, so successful abuse allows unauthorized reads or modifications of cluster-internal Kubernetes or service APIs and disclosure of cloud metadata credentials. Anyone running an affected version of the open-source Kubeflow Pipelines frontend is affected, with the greatest risk where the dashboard is reachable by untrusted users or exposed to the internet. There is currently no known public proof of concept, the flaw is not in the CISA KEV catalog, and EPSS assigns roughly a 0.4% probability of exploitation within 30 days.

What to do: Upgrade Kubeflow Pipelines to 2.17.0 or later. Until then, restrict access to the _proxy routes at the ingress/reverse-proxy layer and apply Kubernetes NetworkPolicies or egress filtering so the frontend cannot reach link-local (169.254.169.254) metadata, loopback, RFC1918, or cluster-internal addresses; note that ENABLE_AUTHZ=true does not cover this route. Review logs for unauthenticated requests to the four _proxy paths and rotate any cloud metadata or service credentials if internal endpoints may have been reached.