Prior to 2.17.0, Kubeflow Pipelines frontend exposes an unauthenticated Server‑Side Request Forgery via the /_proxy/ route. The /_proxy/ handler accepts any HTTP or HTTPS target, forwards all request headers—including Authorization, Cookie, and X‑Forwarded‑For—without a host allowlist, allowing an attacker to reach loopback, RFC1918, or cluster‑local addresses. If ENABLE_AUTHZ=true, the route remains outside the authorization middleware, so anyone with access to the UI can read or modify internal services, potentially exposing cloud metadata credentials, Kubernetes APIs, or other cluster‑internal endpoints.

Kubeflow Pipelines is the vendor and product; all frontend deployments running Kubeflow Pipelines versions prior to 2.17.0 are vulnerable. The unprotected routes include /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, and /pipeline/apis/v2beta1/_proxy/, and the issue can also be triggered via a crafted Referer header. No specific minor releases are listed beyond the major 2.17.0 fix, so any earlier build must be considered at risk.

With a CVSS score of 10, this flaw represents a high‑severity, remote exploitation vector that does not require authentication. The EPSS score is not available, but the flaw is not yet listed in CISA KEV, indicating no publicly known exploits yet. Nevertheless, because the route is reachable by any user of the Pipelines UI and allows arbitrary outbound traffic, the likelihood of misuse is high, especially in shared or multi‑tenant clusters where internal services are valuable targets.