The vulnerability exists in KServe’s storage‑initializer init container, which trusts a user‑supplied storageUri. An attacker who can create or edit InferenceService custom resources within their namespace may specify a malicious storageUri that points to any external URL. When the init container resolves this URI, it inadvertently performs an HTTP/HTTPS request from inside the cluster, exposing a classic Server‑Side Request Forgery (SSRF) flaw. This can reveal internal network details, exfiltrate node IAM credentials, or access other cluster services that should remain isolated.

Red Hat OpenShift AI (RHOAI) deployments that run KServe within a namespace where users have create/update permissions on InferenceService resources. The flaw does not affect RHOAI hosts or components that do not use the storage‑initializer init container.

The CVSS score of 7.7 categorizes this issue as high severity, and the lack of an EPSS score indicates no publicly known exploitation data yet. The flaw is not currently listed in CISA KEV, but the attack surface is significant because any privileged user can trigger external calls. The SSRF vulnerability permits uncontrolled outbound traffic, allowing an attacker to pivot within the cluster and potentially compromise IAM roles. The resolver logic in the init container does not impose domain restrictions, making exploitation straightforward without additional prerequisites.