https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 03:39:09 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-88983 <p>Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server&#39;s pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.</p> <p>Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server&#39;s pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-88983 https://db.gcve.eu/vuln/ghsa-f7vj-6669-qvv4 <p><strong>Affected:</strong> Go: github.com/kubeflow/pipelines</p> <p>## Summary</p> <p>The Kubeflow Pipelines API server fetched caller-supplied pipeline package URLs without restricting the destination. A caller authorized to create a pipeline or pipeline version could cause requests to originate from the API server&#39;s network position, including to internal services that the caller could not otherwise reach.</p> <p>## Impact</p> <p>The reported evidence demonstrates blind server-side request forgery and a limited status-code oracle. The fetched response is processed as a pipeline package; the report does not demonstrate arbitrary response-body disclosure or credential theft. A request to a cloud metadata endpoint returned HTTP 403, which does not establish access to metadata contents or tokens.</p> <p>The confidentiality metric is Low to reflect the limited information obtainable through the status-code oracle. High confidentiality impact and integrity or availability impact are not established by the submitted evidence. Impact depends on the API server&#39;s network reachability and the deployment&#39;s trust boundaries.</p> <p>## Patches</p> <p>Fixed by [kubeflow/pipelines#12750](https://github.com/kubeflow/pipelines/pull/12750), first released in 2.17.0. The fix validates URL schemes, ports, allowed domains, and resolved IP addresses; validates redirects; and enforces IP restrictions at connection time. The HTTP client also applies timeouts and disables environment proxy use so connections pass through the validated dialer.</p> <p>Operators should keep pipeline URL validation enabled and…</p> <p><strong>Affected:</strong> Go: github.com/kubeflow/pipelines</p> <p>## Summary</p> <p>The Kubeflow Pipelines API server fetched caller-supplied pipeline package URLs without restricting the destination. A caller authorized to create a pipeline or pipeline version could cause requests to originate from the API server&#39;s network position, including to internal services that the caller could not otherwise reach.</p> <p>## Impact</p> <p>The reported evidence demonstrates blind server-side request forgery and a limited status-code oracle. The fetched response is processed as a pipeline package; the report does not demonstrate arbitrary response-body disclosure or credential theft. A request to a cloud metadata endpoint returned HTTP 403, which does not establish access to metadata contents or tokens.</p> <p>The confidentiality metric is Low to reflect the limited information obtainable through the status-code oracle. High confidentiality impact and integrity or availability impact are not established by the submitted evidence. Impact depends on the API server&#39;s network reachability and the deployment&#39;s trust boundaries.</p> <p>## Patches</p> <p>Fixed by [kubeflow/pipelines#12750](https://github.com/kubeflow/pipelines/pull/12750), first released in 2.17.0. The fix validates URL schemes, ports, allowed domains, and resolved IP addresses; validates redirects; and enforces IP restrictions at connection time. The HTTP client also applies timeouts and disables environment proxy use so connections pass through the validated dialer.</p> <p>Operators should keep pipeline URL validation enabled and…</p> https://db.gcve.eu/vuln/ghsa-f7vj-6669-qvv4