# CVE-2026-110220: Kubeflow Model Registry server-side request forgery

Source: https://junglewise.ai/threats/cve-2026-110220-kubeflow-model-registry-through-0-3-17-contains-a-server-side  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110220 · Severity: high · CVSS 7.1 · Published 2026-10-13

Kubeflow Model Registry is a system that manages ML models and their metadata across a Kubernetes cluster. A flaw allows users within a Kubernetes namespace to steal the controller's authentication token by pointing an annotation at their own server, then use that token to modify other teams' machine learning models cluster-wide.

Vendors: [Kubeflow](https://junglewise.ai/threats/vendors/kubeflow).

## Quick answers

**Is CVE-2026-110220 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110220 being exploited in the wild.

**How severe is CVE-2026-110220?** High severity, with a CVSS score of 7.1, published 13 October 2026.

**Which products and versions are affected?** Kubeflow Model Registry through 0.3.17.

**Is there a fix for CVE-2026-110220?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-110220 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110220?** Check whether you run Kubeflow Model Registry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability in the controller processes the modelregistry.kubeflow.org/url annotation on InferenceService objects without proper validation. Namespace-level users can create a crafted InferenceService that directs the controller to fetch from attacker-controlled endpoints, leaking the controller's ServiceAccount bearer token in the HTTP request. The attacker then gains the controller's permissions to modify InferenceServices across all namespaces in the cluster.

## Affected products

- Kubeflow Model Registry through 0.3.17

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/kubeflow/hub](https://github.com/kubeflow/hub)
- [https://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go](https://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go)