An unauthenticated artifact route in standalone Kubeflow Pipelines could make the UI service fetch an attacker-chosen internal endpoint. Entry and authority. An affected standalone frontend exposes the artifact download handler without authentication. Observed mechanism and consequence. The privileged backend made requests to selected private or…
Inspect the ClaimsCase · DiggingBeagle record
Kubeflow artifact download accepted arbitrary storage endpoints
An unauthenticated artifact route in standalone Kubeflow Pipelines could make the UI service fetch an attacker-chosen internal endpoint.
Public disclosure: Oct 28, 2026
Scope
An affected standalone frontend exposes the artifact download handler without authentication. The privileged backend made requests to selected private or link-local destinations and could return their responses.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-KUBEFLOW-ARTIFACT-SSRF; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-KUBEFLOW-ARTIFACT-SSRF-01 · CLM-DB233-KUBEFLOW-ARTIFACT-SSRF-02 · Kubeflow Pipelines security advisory GHSA-3pcj-8j5w-jmxq
At a glance
Reported fixed 2.18.0; no real cloud credential leak or broad installation exposure measured.
Limits and uncertaintyFull account
An unauthenticated artifact route in standalone Kubeflow Pipelines could make the UI service fetch an attacker-chosen internal endpoint.
Entry and authority. An affected standalone frontend exposes the artifact download handler without authentication.
Observed mechanism and consequence. The privileged backend made requests to selected private or link-local destinations and could return their responses.
Limits and status. Reported fixed 2.18.0; no real cloud credential leak or broad installation exposure measured.
The Kubeflow Pipelines artifact route accepted a caller-selected provider endpoint and then fetched data from the server's network context. In the standalone configuration described by the advisory, this allowed an unauthenticated caller to induce requests to otherwise internal HTTP endpoints. A successful outbound request need not mean that cloud metadata requiring special headers or tokens was disclosed.
Mechanism and trust boundary
- 01
Precondition and trust context
An affected standalone frontend exposes the artifact download handler without authentication.
- 02
Crossed boundary
The privileged backend made requests to selected private or link-local destinations and could return their responses.
- 03
Observed limit
Reported fixed 2.18.0; no real cloud credential leak or broad installation exposure measured.
Timeline
- Oct 28, 2026Event type unspecified
Initial documented finding
Kubeflow artifact download accepted arbitrary storage endpoints
- Oct 28, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-KUBEFLOW-ARTIFACT-SSRF-01The Kubeflow advisory reports: The frontend accepted caller-selected S3/MinIO provider metadata as part of artifact download.supported
Basis: reported finding
- supportsKubeflow Pipelines security advisory GHSA-3pcj-8j5w-jmxqprimary disclosure
Advisory Summary and Proof of Concept
CLM-DB233-KUBEFLOW-ARTIFACT-SSRF-02The reported repair is version 2.18.0, with the specific affected component and version range described in the advisory.supported
Basis: reported finding
- supportsKubeflow Pipelines security advisory GHSA-3pcj-8j5w-jmxqprimary disclosure
Advisory Affected and Patched Versions
Controls and mitigations
- Allow only operator-configured storage providers, enforce authentication on artifact download and block internal/link-local outbound destinations; use the upstream fix.
- Test the full egress path and redirects from the pipeline UI service rather than trusting checks on the client-facing URL alone.
Unknowns and contradictions
- Reported fixed 2.18.0; no real cloud credential leak or broad installation exposure measured.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235