{"metadata": {"vulnerability": "CVE-2026-110220", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110220", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T17:59:34.697Z", "date_only": false, "value": "2026-10-13T17:59:34.697Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110220", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T18:50:07.237Z", "date_only": false, "value": "2026-10-13T18:50:07.237Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110220", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T18:50:07.237Z", "date_only": false, "value": "2026-10-13T18:50:07.237Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110220", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T19:15:38.671Z", "date_only": false, "value": "2026-10-13T19:15:38.671042Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117435199531140415", "record": "CVE-2026-110220", "field": "creation_timestamp", "uuid": "ebce6630-fdb3-4f88-bc26-de94cddeeb9d", "content": "CVE-2026-110220 Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110220https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwardinghttps://github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.go#L268-L292https://github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.go#L420-L423https://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go#L224-L228https://github.com/kubeflow/hubhttps://www.vulncheck.com/advisories/kubeflow-model-registry-through-0.3.17-ssrf-via-inferenceservice-controller-url-annotation#Kubeflow #ModelRegistry#CVE_2026_110220#bot", "url": "https://infosec.exchange/users/cve/statuses/117435199531140415"}, {"timestamp": "2026-10-13T19:18:46Z", "date_only": false, "value": "2026-10-13T19:18:46Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-Q9M2-3393-574Q", "record": "GHSA-Q9M2-3393-574Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T19:18:46.413Z", "date_only": false, "value": "2026-10-13T19:18:46.413", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110220", "record": "FKIE_CVE-2026-110220", "field": "published"}, {"timestamp": "2026-10-13T21:33:38Z", "date_only": false, "value": "2026-10-13T21:33:38Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-Q9M2-3393-574Q", "record": "GHSA-Q9M2-3393-574Q", "field": "published"}, {"timestamp": "2026-10-13T21:33:38Z", "date_only": false, "value": "2026-10-13T21:33:38Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-Q9M2-3393-574Q", "record": "GHSA-Q9M2-3393-574Q", "field": "modified"}, {"timestamp": "2026-10-26T18:31:25.083Z", "date_only": false, "value": "2026-10-26T18:31:25.083473Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110220", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-26T18:31:25.083Z", "date_only": false, "value": "2026-10-26T18:31:25.083473Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110220", "record": "FKIE_CVE-2026-110220", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-26T18:31:35.835Z", "date_only": false, "value": "2026-10-26T18:31:35.835Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110220", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-26T18:31:35.835Z", "date_only": false, "value": "2026-10-26T18:31:35.835Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110220", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T19:16:29.353Z", "date_only": false, "value": "2026-10-26T19:16:29.353", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110220", "record": "FKIE_CVE-2026-110220", "field": "lastModified"}]}