Kserve: kserve: server-side request forgery via malicious storageuri

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious storageUri. This Server-Side Request Forgery (SSRF) vulnerability allows the storage-initializer init container to issue arbitrary outbound HTTP/HTTPS requests from inside the cluster. This can lead to information disclosure, including credential theft for the node's Identity and Access Management (IAM) role or access to internal cluster services.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-13451 Diğer

Kayıt geçmişi

1. 28 Eki 2026 22:52Yayımlandı

İlgili açıklar

• 9,1 CVE-2026-117574Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization
• 3,3 CVE-2026-114236Podman storage/pkg/archive katmanı işlenirken dosya tanımlayıcı sızıntısı
• 6,5 CVE-2026-17557Red Hat OpenShift AI lm-evaluation-harness bileşeninde SSRF ve kimlik bilgisi sızıntısı açığı
• 4,7 CVE-2026-61529Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)
• 8,3 CVE-2025-14260Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
• 7,5 CVE-2026-118679n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger