This vulnerability, classified as Server‑Side Request Forgery (CWE‑918) and stemming from Improper Authentication (CWE‑798) and Improper Authorization (CWE‑1392), occurs because the TensorBoard proxy token was created using the publicly known MINIO_SECRET_KEY as the HMAC secret in Kubeflow Pipelines versions 2.17.0 through 2.18.0. A malicious user can forge a token containing a desired viewerName and namespace, causing the proxy to forward an HTTP request to an arbitrary internal service on port 80. The proxy still rejects path traversal and, in deployments where authorization is enabled, requires proper namespace access. As a result, the impact is limited to reading data from services reachable behind the proxy; there is no capability to modify resources or cause service disruption.

Affected systems are Kubeflow Pipelines versions 2.17.0 up to, but not including, 2.18.0. Vulnerability affects only deployments with authorization disabled and the default MINIO_SECRET_KEY in effect. The issue was patched in release 2.18.0 and does not exist in later versions.

The CVSS score of 5.8 indicates medium‑to‑high severity, while the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an unauthenticated attacker who can reach the Kubeflow Pipelines service can forge a token and direct the proxy to any internal HTTP service on the cluster’s port 80. Exploitation requires no special privileges beyond sending a request to the proxy endpoint, yet the attacker can only read information from services accessed via the proxy.