Server-Side Request Forgery in KServe Affects Namespace-Scoped Users
CVE-2026-13451

7.7HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
28 October 2026

What is CVE-2026-13451?

A vulnerability has been identified in KServe that allows users with specific create/update permissions on InferenceService custom resources to exploit a flaw by supplying a malicious storageUri. This Server-Side Request Forgery (SSRF) flaw can enable the storage-initializer init container to make arbitrary outbound HTTP/HTTPS requests from within the cluster. The implications of this vulnerability include potential exposure of sensitive information, such as credentials associated with the node's Identity and Access Management (IAM) role, along with unauthorized access to internal cluster services, raising significant security concerns for affected environments.

References

https://access.redhat.com/security/cve/CVE-2026-13451
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2493640
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.