The vulnerability is a server-side request forgery that permits namespace users to abuse the modelregistry.kubeflow.org/url annotation in an InferenceService. By pointing the annotation at a malicious endpoint, an attacker can capture the controller ServiceAccount bearer token and subsequently modify any InferenceService across the entire cluster. This results in privilege escalation and potential tampering of other tenants’ workloads. The weakness corresponds to CWE‑918.

The affected product is Kubeflow Model Registry for all releases up to version 0.3.17. Namespace users of the Kubeflow:Model Registry component are subject to the flaw, and any cluster that deploys the affected controller may be impacted.

The CVSS score is 7.1, indicating a high severity. The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. A likely attack vector involves a malicious namespace user creating an InferenceService with a forged URL annotation. The attacker must have permission to create InferenceService objects; after exploiting the SSRF, they obtain the controller ServiceAccount token, which can be used to manipulate cluster‑wide resources, allowing broad privilege escalation.