CVE-2026-13451

KServe model storage URI can trigger internal requests from a cluster

Red Hat / KServe · KServe storage-initializer in Red Hat OpenShift AI

First documented disclosure · Review checkpoint

Summary

A namespace user who can define model services can redirect storage initialization toward internal services.

Severity and exploitation evidence

High · 7.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The vendor record describes the vulnerability and its potential impact; it does not establish in-the-wild exploitation, a public exploit or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A malicious storageUri in an InferenceService custom resource causes the storage-initializer init container to issue outbound HTTP or HTTPS requests from inside the cluster.

Conditions required

A namespace-scoped user needs create or update permission on InferenceService resources; the destination must be reachable from the container. This does not describe unauthenticated public access.

Potential impact

Potential disclosure of internal service data or credentials for the node IAM role, subject to destination reachability and metadata protections.

Affected versions and configurations

The CNA marks Red Hat OpenShift AI KServe agent, autogluon-server, controller, router and storage-initializer RHEL 9 packages affected; it provides no numeric version ranges.

Fix and mitigation status

No issue-specific fixed release is established in the reviewed full CNA.

Practical next steps

Restrict InferenceService creation and update permissions, allow only trusted model-storage origins, and constrain storage-initializer egress to block internal and metadata destinations. Track the vendor for an issue-specific fixed release.

Operating lesson

A model-storage URL is a network request capability; namespace authorization alone does not constrain its destination.

Evidence and limits

Red Hat explicitly records October 27 as the public date, separate from its June 26 private report and October 28 CVE publication. Its qualitative rating is Important; the displayed High label comes from its CVSS 3.1 score. Red Hat detail pages and the security-data API were inaccessible during this review; claims rely on the full published Red Hat CNA, not snippets. No patch version or observed compromise is inferred.

Sources