Kubeflow Pipelines versions prior to 2.17.0 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the frontend proxy middleware. The /_proxy/ route in frontend/server/proxy-middleware.ts allows attackers to supply arbitrary HTTP/HTTPS targets without any host allowlist or filtering for internal address ranges. The vulnerable route bypasses authorization middleware even when ENABLE_AUTHZ=true, and is accessible via multiple API path prefixes as well as through crafted Referer headers. Exploiting this flaw allows attackers to forward arbitrary methods, sensitive headers (Authorization, Cookie, X-Forwarded-For), and POST bodies to internal services, with responses returned to the unauthenticated caller. This can result in exposure of cloud metadata credentials, Kubernetes API access, and other cluster-internal endpoints. The vulnerability poses significant risk in cloud-native ML environments where Kubeflow Pipelines is deployed. The issue has been remediated in Kubeflow Pipelines version 2.17.0.
