NVD security advisory
Security advisory for A flaw was found in KServe
CVE-2026-13451
Full advisory details, affected packages, severity context, and original source.
Affected technology
A flaw was found in KServeAffected product
Advisory overview
A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `storageUri`. This Server-Side Request Forgery (SSRF) vulnerability allows the `storage-initializer` init container to issue arbitrary outbound HTTP/HTTPS requests from inside the cluster. This can lead to information disclosure, including credential theft for the node's Identity and Access Management (IAM) role or access to internal cluster services.