KServe storageUri fetched model artifacts from cluster-network destinations

KServe storage initialization accepted a user-supplied InferenceService storageUri as an outbound fetch location without adequately restricting internal network destinations.

The caller must have rights to create the relevant Kubernetes InferenceService; exploitation operates under the storage-initializer pod network context. A selected internal address could receive a fetch from a more privileged cluster network zone, exposing reachable services to request-side effects.

The advisory does not verify cloud metadata credential theft or establish a packaged fixed version. Constrain InferenceService storageUri schemes and destinations and apply network egress restrictions to model storage initializer pods.

Evidence interpretation and control boundary. The important authority is the cluster-network position of the storage-initializer container: an InferenceService author may have only namespace privileges yet cause an initializer to fetch a host that its own identity cannot normally reach. Whether the requested endpoint reveals metadata or credentials depends on network policy and destination response. The advisory should be tested with a controlled internal endpoint, not reported as established cloud credential theft.