Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route remains outside the authorization middleware when ENABLE_AUTHZ=true and is reachable through /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, and /pipeline/apis/v2beta1/_proxy/, including through a crafted Referer header. Requests can forward attacker-controlled methods, headers such as Authorization, Cookie, and X-Forwarded-For, and POST bodies to reachable internal services, while returning the upstream response to the unauthenticated client. This can expose cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification. This issue is fixed in version 2.17.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-29 | 2 | Disclosure1General1 |
| 2026-09-02 | 1 | Patch1 |
| 2026-09-22 | 1 | Disclosure1 |
| 2026-09-23 | 1 | Disclosure1 |
| 2026-09-24 | 2 | Disclosure1Patch1 |
| 2026-09-25 | 1 | Patch1 |
| 2026-09-26 | 1 | Disclosure1 |
| 2026-09-27 | 1 | Disclosure1 |
Critical vulnerability alert: CVE-2026-54745 with a CVSS score of 10. Kubeflow Pipelines enables users to build and deploy.... Security teams should prioritize patching this one. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The tweet alerts security teams to a critical vulnerability in Kubeflow Pipelines (CVE-2026-54745, CVSS 10) and explicitly directs them to prioritize patching.
CVE-2026-54745 just dropped with a CVSS score of 10. Kubeflow Pipelines enables users to build and deploy.... This is a serious one that needs immediate attention. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The tweet announces CVE-2026-54745 with a CVSS score of 10 affecting Kubeflow Pipelines, stressing the need for immediate attention and providing a link for further details. No exploit, patch, or active exploitation is claimed.
CVE-2026-54745 just dropped with a CVSS score of 10. Kubeflow Pipelines enables users to build and deploy.... This is a serious one that needs immediate attention. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The text announces CVE-2026-54745 with a CVSS 10 score affecting Kubeflow Pipelines and urges attention, but provides no named patch, exploit tool, or active exploitation evidence — functioning primarily as a vulnerability disclosure with a link to external details.
[CVE] CVE-2026-54745 [HIGH PRIORITY] #Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipel... 🔗 https://exploitgrid.net/cve/CVE-2026-54745
Post summary
The tweet announces a high‑priority vulnerability (CVE‑2026‑54745) in Kubeflow Pipelines, detailing unauthenticated SSRF and HTTP smuggling, and links to an ExploitGrid page that likely hosts a proof of concept.
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-19295 - EXPLOIT CVE-2026-54745 CVE-2026-82222 CVE-2026-18527 CVE-2026-55565 ..🧵👇
Post summary
The brief note lists several CVEs with one labeled "EXPLOIT", but offers no further information on PoCs, exploit code, or operational impacts.
CVE-2026-54745 just dropped with a CVSS score of 10. Kubeflow Pipelines enables users to build and deploy.... This is a serious one that needs immediate attention. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The tweet announces CVE-2026-54745 with a CVSS score of 10, emphasizing its severity and urging immediate attention, but does not include PoC, exploit details, patches, or evidence of active exploitation.
🚨 CRITICAL - Unauthenticated SSRF in Kubeflow Pipelines Frontend (CVE-2026-54745) A critical flaw in the /_proxy/ route of the Kubeflow Pipelines frontend allows unauthenticated attackers to bypass authorization checks (ENABLE_AUTHZ=true). Attackers can relay arbitrary HTTP/HTTPS requests to internal cluster services, Kubernetes APIs, and cloud metadata endpoints to extract sensitive credentials. 👉 Affected: Kubeflow Pipelines < 2.17.0 | Upgrade to v2.17.0 or later immediately
Post summary
The text reports a critical unauthenticated SSRF vulnerability (CVE-2026-54745) in Kubeflow Pipelines frontend and directs users to upgrade to v2.17.0+ immediately.
New critical CVE to watch: CVE-2026-54745 with a CVSS score of 10. Kubeflow Pipelines enables users to build and deploy.... If you're affected, patch as soon as possible. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The tweet announces a new critical CVE (CVE-2026-54745) in Kubeflow Pipelines with a CVSS 10.0 score and urges immediate patching, but does not reference a specific patch version, PoC, exploit tool, or active exploitation.
Critical vulnerability alert: CVE-2026-54745 with a CVSS score of 10. Kubeflow Pipelines enables users to build and deploy.... Security teams should prioritize patching this one. Details: https://threatops.tech/exploit-radar #CVE #InfoSec #VulnMgmt
Post summary
The post announces CVE-2026-54745 with a CVSS score of 10 and urges security teams to patch, but does not provide a named fix or exploit code.
🔁 Kubeflow Pipelines CVE-2026-54745: unauthenticated SSRF + HTTP smuggling via the /_proxy/ route bypasses ENABLE_AUTHZ=true. CVSS 10. Upgrade to 2.17.0 now. #cybersecurity #ciso #cto #mlops #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-54745?utm_campaign=x https://t.co/UaNpMta8VG
Post summary
The tweet spotlights a severe SSRF + HTTP smuggling flaw in Kubeflow Pipelines (CVSS 10) and urges users to update to version 2.17.0 to mitigate the risk.