Search
Find a vulnerability
Search criteria
40 vulnerabilities by Kubeflow
CVE-2026-88984 (GCVE-0-2026-88984)
Vulnerability from nvd – Published: 2026-11-05 22:13 – Updated: 2026-11-09 17:41
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability. Read-only access to shared pipelines remains intentional, single-user deployments intentionally bypass multi-user checks, and execution of a modified pipeline is a conditional downstream consequence. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not remediated by version 2.16.1. This issue is fixed in version 2.16.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:36 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13288 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/186d… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88984",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:36:12.430452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:41:17.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.16.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability. Read-only access to shared pipelines remains intentional, single-user deployments intentionally bypass multi-user checks, and execution of a modified pipeline is a conditional downstream consequence. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not remediated by version 2.16.1. This issue is fixed in version 2.16.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:13:12.954Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13288",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13288"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.16.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.16.1"
}
],
"source": {
"advisory": "GHSA-ghgh-57qv-h687",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88984",
"datePublished": "2026-11-05T22:13:12.954Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-09T17:41:17.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88982 (GCVE-0-2026-88982)
Vulnerability from nvd – Published: 2026-11-05 22:25 – Updated: 2026-11-05 22:25
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0.
Severity
5.4 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14359 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/620d… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace\u0027s cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:25:58.995Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14359",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14359"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-2xwh-426q-42c5",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88982",
"datePublished": "2026-11-05T22:25:58.995Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-05T22:25:58.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88981 (GCVE-0-2026-88981)
Vulnerability from nvd – Published: 2026-11-05 22:21 – Updated: 2026-11-06 17:41
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials. Multi-user secret-backed metadata remains restricted to the server namespace. This issue is fixed in version 2.18.0.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 17:40 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14349 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/0b77… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T17:40:55.340212Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:41:11.589Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials. Multi-user secret-backed metadata remains restricted to the server namespace. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:21:30.033Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-3pcj-8j5w-jmxq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-3pcj-8j5w-jmxq"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14349",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14349"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/0b77f9b07bfb9860dc90106003bbc3e2fe0e0965",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/0b77f9b07bfb9860dc90106003bbc3e2fe0e0965"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-3pcj-8j5w-jmxq",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88981",
"datePublished": "2026-11-05T22:21:30.033Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-06T17:41:11.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88980 (GCVE-0-2026-88980)
Vulnerability from nvd – Published: 2026-11-05 22:18 – Updated: 2026-11-05 22:18
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0.
Severity
8.6 (High)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13677 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/4d9b… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:18:05.010Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-v3vh-xv5f-p4p4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-v3vh-xv5f-p4p4"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13677",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13677"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-v3vh-xv5f-p4p4",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88980",
"datePublished": "2026-11-05T22:18:05.010Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-05T22:18:05.010Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88979 (GCVE-0-2026-88979)
Vulnerability from nvd – Published: 2026-11-05 22:14 – Updated: 2026-11-06 17:39
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0.
Severity
5.8 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 17:39 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14346 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/c8ef… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88979",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T17:39:20.562426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:39:46.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.17.0, \u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/\u003cviewer\u003e/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:14:38.071Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14346",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14346"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-j429-j7xw-8j9h",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88979",
"datePublished": "2026-11-05T22:14:38.071Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-06T17:39:46.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77596 (GCVE-0-2026-77596)
Vulnerability from nvd – Published: 2026-11-05 22:23 – Updated: 2026-11-05 22:23
VLAI
EPSS
VEX
Title
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant's namespace under that workload's service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0.
Severity
9.6 (Critical)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14352 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/6251… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant\u0027s namespace under that workload\u0027s service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:23:13.049Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14352",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14352"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-rjr3-43j3-4q8g",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines API server lacks authorization for shared pipeline uploads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77596",
"datePublished": "2026-11-05T22:23:13.049Z",
"dateReserved": "2026-08-20T20:48:20.507Z",
"dateUpdated": "2026-11-05T22:23:13.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88986 (GCVE-0-2026-88986)
Vulnerability from nvd – Published: 2026-11-05 22:08 – Updated: 2026-11-05 22:08
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment's authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/12295 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/fedc… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment\u0027s authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:08:32.749Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-g3qx-frcg-j979",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-g3qx-frcg-j979"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/12295",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/12295"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/fedc25e3f7251933d4a37b964bc3e8176beea28e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/fedc25e3f7251933d4a37b964bc3e8176beea28e"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.15.0"
}
],
"source": {
"advisory": "GHSA-g3qx-frcg-j979",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88986",
"datePublished": "2026-11-05T22:08:32.749Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-05T22:08:32.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88985 (GCVE-0-2026-88985)
Vulnerability from nvd – Published: 2026-11-05 22:06 – Updated: 2026-11-09 17:41
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:36 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13127 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/ac3a… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88985",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:36:07.982475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:41:27.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:06:15.200Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-r4mx-2gr2-8277",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-r4mx-2gr2-8277"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13127",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13127"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/ac3a4c65677a3bc7a3d5b1e264fba41178d4ab32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/ac3a4c65677a3bc7a3d5b1e264fba41178d4ab32"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
}
],
"source": {
"advisory": "GHSA-r4mx-2gr2-8277",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88985",
"datePublished": "2026-11-05T22:06:15.200Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-09T17:41:27.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88983 (GCVE-0-2026-88983)
Vulnerability from nvd – Published: 2026-11-05 21:58 – Updated: 2026-11-05 21:58
VLAI
EPSS
VEX
Title
Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.
Severity
5 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/12750 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/504d… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server\u0027s pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:58:53.008Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/12750",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/12750"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
}
],
"source": {
"advisory": "GHSA-f7vj-6669-qvv4",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines \u2014 API server fetches a caller-supplied pipelineURL without host validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88983",
"datePublished": "2026-11-05T21:58:53.008Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-05T21:58:53.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118761 (GCVE-0-2026-118761)
Vulnerability from nvd – Published: 2026-10-29 16:37 – Updated: 2026-10-29 20:18
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:18 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14171 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/pull/14186 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/1121… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/ba9a… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118761",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T20:18:49.737846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:18:59.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:37:44.333Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14171",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14171"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14186",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14186"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-8fmv-6rg5-5924",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118761",
"datePublished": "2026-10-29T16:37:44.333Z",
"dateReserved": "2026-10-28T19:20:05.017Z",
"dateUpdated": "2026-10-29T20:18:59.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118760 (GCVE-0-2026-118760)
Vulnerability from nvd – Published: 2026-10-29 16:35 – Updated: 2026-11-03 16:03
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:03 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/issues/9889 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/pull/12860 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/fb69… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118760",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:03:36.414605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:03:50.453Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant\u0027s namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:35:05.192Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj"
},
{
"name": "https://github.com/kubeflow/pipelines/issues/9889",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/issues/9889"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/12860",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/12860"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
}
],
"source": {
"advisory": "GHSA-vjhf-6c8f-qhwj",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118760",
"datePublished": "2026-10-29T16:35:05.192Z",
"dateReserved": "2026-10-28T19:20:05.017Z",
"dateUpdated": "2026-11-03T16:03:50.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118759 (GCVE-0-2026-118759)
Vulnerability from nvd – Published: 2026-10-29 16:30 – Updated: 2026-10-30 17:13
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and suitable pod or node identifier can read live or archived logs with the API server's permissions. For live logs, the caller-controlled node ID was also accepted as a pod name without verifying that the pod belonged to the requested run, allowing a known run ID to select the namespace of an unrelated pod and read its main container logs. The handler does not authenticate requests itself, although an external authentication gate or network policy can limit reachability. Exposed logs can contain sensitive workload data or credentials. This issue is fixed in version 2.18.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:47 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13684 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/be47… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118759",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:47:06.206005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:13:29.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server\u0027s GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and suitable pod or node identifier can read live or archived logs with the API server\u0027s permissions. For live logs, the caller-controlled node ID was also accepted as a pod name without verifying that the pod belonged to the requested run, allowing a known run ID to select the namespace of an unrelated pod and read its main container logs. The handler does not authenticate requests itself, although an external authentication gate or network policy can limit reachability. Exposed logs can contain sensitive workload data or credentials. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:30:25.711Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13684",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13684"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/be4723e33727c6dad71a95cba61e8f61562ab20f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/be4723e33727c6dad71a95cba61e8f61562ab20f"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-wg5q-x4j9-qm54",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118759",
"datePublished": "2026-10-29T16:30:25.711Z",
"dateReserved": "2026-10-28T19:20:05.016Z",
"dateUpdated": "2026-10-30T17:13:29.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118758 (GCVE-0-2026-118758)
Vulnerability from nvd – Published: 2026-10-29 16:12 – Updated: 2026-10-29 20:18
VLAI
EPSS
VEX
Title
Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:18 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13677 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/4d9b… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/blob/2.18.0… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T20:18:21.704175Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:18:30.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace\u0027s artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:12:42.138Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13677",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13677"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f"
},
{
"name": "https://github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md#custom-storage-configuration-and-rollout",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md#custom-storage-configuration-and-rollout"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-2fg9-fx2f-439r",
"discovery": "UNKNOWN"
},
"title": "Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118758",
"datePublished": "2026-10-29T16:12:42.138Z",
"dateReserved": "2026-10-28T19:20:05.016Z",
"dateUpdated": "2026-10-29T20:18:30.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110220 (GCVE-0-2026-110220)
Vulnerability from nvd – Published: 2026-10-13 18:50 – Updated: 2026-10-26 18:31
VLAI
EPSS
VEX
Title
Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation
Summary
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 18:31 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflo… | third-party-advisory |
| https://github.com/kubeflow/hub/blob/v0.3.17/pkg/… | technical-description |
| https://github.com/kubeflow/hub/blob/v0.3.17/pkg/… | technical-description |
| https://github.com/kubeflow/hub/blob/v0.3.17/cmd/… | technical-description |
| https://github.com/kubeflow/hub | product |
| https://www.vulncheck.com/advisories/kubeflow-mod… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kubeflow | Model Registry |
Affected:
0 , ≤ 0.3.17
(semver)
|
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110220",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T18:31:25.083473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T18:31:35.835Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Model Registry",
"repo": "https://github.com/kubeflow/hub",
"vendor": "Kubeflow",
"versions": [
{
"lessThanOrEqual": "0.3.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants\u0027 InferenceServices cluster-wide."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:50:07.237Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.go#L268-L292"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.go#L420-L423"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go#L224-L228"
},
{
"tags": [
"product"
],
"url": "https://github.com/kubeflow/hub"
},
{
"name": "VulnCheck Advisory: Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kubeflow-model-registry-through-0.3.17-ssrf-via-inferenceservice-controller-url-annotation"
}
],
"title": "Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110220",
"datePublished": "2026-10-13T18:50:07.237Z",
"dateReserved": "2026-10-13T17:59:34.697Z",
"dateUpdated": "2026-10-26T18:31:35.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54745 (GCVE-0-2026-54745)
Vulnerability from nvd – Published: 2026-08-28 15:59 – Updated: 2026-08-31 19:10
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route remains outside the authorization middleware when ENABLE_AUTHZ=true and is reachable through /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, and /pipeline/apis/v2beta1/_proxy/, including through a crafted Referer header. Requests can forward attacker-controlled methods, headers such as Authorization, Cookie, and X-Forwarded-For, and POST bodies to reachable internal services, while returning the upstream response to the unauthenticated client. This can expose cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification. This issue is fixed in version 2.17.0.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 19:09 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13511 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/a35f… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54745",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T19:09:39.730504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T19:10:06.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route remains outside the authorization middleware when ENABLE_AUTHZ=true and is reachable through /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, and /pipeline/apis/v2beta1/_proxy/, including through a crafted Referer header. Requests can forward attacker-controlled methods, headers such as Authorization, Cookie, and X-Forwarded-For, and POST bodies to reachable internal services, while returning the upstream response to the unauthenticated client. This can expose cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification. This issue is fixed in version 2.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:59:01.118Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13511",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13511"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
}
],
"source": {
"advisory": "GHSA-gqww-5pj5-8fq7",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54745",
"datePublished": "2026-08-28T15:59:01.118Z",
"dateReserved": "2026-06-15T23:12:41.964Z",
"dateUpdated": "2026-08-31T19:10:06.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88982 (GCVE-0-2026-88982)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:25 – Updated: 2026-11-05 22:25
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0.
Severity
5.4 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14359 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/620d… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace\u0027s cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:25:58.995Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14359",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14359"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-2xwh-426q-42c5",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88982",
"datePublished": "2026-11-05T22:25:58.995Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-05T22:25:58.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77596 (GCVE-0-2026-77596)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:23 – Updated: 2026-11-05 22:23
VLAI
EPSS
VEX
Title
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant's namespace under that workload's service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0.
Severity
9.6 (Critical)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14352 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/6251… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant\u0027s namespace under that workload\u0027s service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:23:13.049Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14352",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14352"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-rjr3-43j3-4q8g",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines API server lacks authorization for shared pipeline uploads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77596",
"datePublished": "2026-11-05T22:23:13.049Z",
"dateReserved": "2026-08-20T20:48:20.507Z",
"dateUpdated": "2026-11-05T22:23:13.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88981 (GCVE-0-2026-88981)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:21 – Updated: 2026-11-06 17:41
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials. Multi-user secret-backed metadata remains restricted to the server namespace. This issue is fixed in version 2.18.0.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 17:40 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14349 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/0b77… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T17:40:55.340212Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:41:11.589Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials. Multi-user secret-backed metadata remains restricted to the server namespace. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:21:30.033Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-3pcj-8j5w-jmxq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-3pcj-8j5w-jmxq"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14349",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14349"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/0b77f9b07bfb9860dc90106003bbc3e2fe0e0965",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/0b77f9b07bfb9860dc90106003bbc3e2fe0e0965"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-3pcj-8j5w-jmxq",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88981",
"datePublished": "2026-11-05T22:21:30.033Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-06T17:41:11.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88980 (GCVE-0-2026-88980)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:18 – Updated: 2026-11-05 22:18
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0.
Severity
8.6 (High)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13677 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/4d9b… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:18:05.010Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-v3vh-xv5f-p4p4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-v3vh-xv5f-p4p4"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13677",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13677"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-v3vh-xv5f-p4p4",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88980",
"datePublished": "2026-11-05T22:18:05.010Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-05T22:18:05.010Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88979 (GCVE-0-2026-88979)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:14 – Updated: 2026-11-06 17:39
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0.
Severity
5.8 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 17:39 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14346 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/c8ef… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88979",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T17:39:20.562426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:39:46.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.17.0, \u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/\u003cviewer\u003e/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:14:38.071Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14346",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14346"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-j429-j7xw-8j9h",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88979",
"datePublished": "2026-11-05T22:14:38.071Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-06T17:39:46.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88984 (GCVE-0-2026-88984)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:13 – Updated: 2026-11-09 17:41
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability. Read-only access to shared pipelines remains intentional, single-user deployments intentionally bypass multi-user checks, and execution of a modified pipeline is a conditional downstream consequence. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not remediated by version 2.16.1. This issue is fixed in version 2.16.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:36 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13288 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/186d… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88984",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:36:12.430452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:41:17.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.16.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability. Read-only access to shared pipelines remains intentional, single-user deployments intentionally bypass multi-user checks, and execution of a modified pipeline is a conditional downstream consequence. The separate shared-pipeline multipart upload authorization path is outside this advisory and is not remediated by version 2.16.1. This issue is fixed in version 2.16.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:13:12.954Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-ghgh-57qv-h687"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13288",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13288"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/186dd1f3b0403af841c9b4ea7ab94f405339ef6c"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.16.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.16.1"
}
],
"source": {
"advisory": "GHSA-ghgh-57qv-h687",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88984",
"datePublished": "2026-11-05T22:13:12.954Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-09T17:41:17.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88986 (GCVE-0-2026-88986)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:08 – Updated: 2026-11-05 22:08
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment's authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/12295 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/fedc… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment\u0027s authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:08:32.749Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-g3qx-frcg-j979",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-g3qx-frcg-j979"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/12295",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/12295"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/fedc25e3f7251933d4a37b964bc3e8176beea28e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/fedc25e3f7251933d4a37b964bc3e8176beea28e"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.15.0"
}
],
"source": {
"advisory": "GHSA-g3qx-frcg-j979",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88986",
"datePublished": "2026-11-05T22:08:32.749Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-05T22:08:32.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88985 (GCVE-0-2026-88985)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:06 – Updated: 2026-11-09 17:41
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:36 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13127 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/ac3a… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88985",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:36:07.982475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:41:27.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:06:15.200Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-r4mx-2gr2-8277",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-r4mx-2gr2-8277"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13127",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13127"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/ac3a4c65677a3bc7a3d5b1e264fba41178d4ab32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/ac3a4c65677a3bc7a3d5b1e264fba41178d4ab32"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
}
],
"source": {
"advisory": "GHSA-r4mx-2gr2-8277",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88985",
"datePublished": "2026-11-05T22:06:15.200Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-09T17:41:27.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88983 (GCVE-0-2026-88983)
Vulnerability from cvelistv5 – Published: 2026-11-05 21:58 – Updated: 2026-11-05 21:58
VLAI
EPSS
VEX
Title
Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.
Severity
5 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/12750 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/504d… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server\u0027s pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:58:53.008Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/12750",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/12750"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
}
],
"source": {
"advisory": "GHSA-f7vj-6669-qvv4",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines \u2014 API server fetches a caller-supplied pipelineURL without host validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88983",
"datePublished": "2026-11-05T21:58:53.008Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-05T21:58:53.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118761 (GCVE-0-2026-118761)
Vulnerability from cvelistv5 – Published: 2026-10-29 16:37 – Updated: 2026-10-29 20:18
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:18 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14171 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/pull/14186 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/1121… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/ba9a… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118761",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T20:18:49.737846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:18:59.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:37:44.333Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14171",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14171"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14186",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14186"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-8fmv-6rg5-5924",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118761",
"datePublished": "2026-10-29T16:37:44.333Z",
"dateReserved": "2026-10-28T19:20:05.017Z",
"dateUpdated": "2026-10-29T20:18:59.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118760 (GCVE-0-2026-118760)
Vulnerability from cvelistv5 – Published: 2026-10-29 16:35 – Updated: 2026-11-03 16:03
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant's namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:03 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/issues/9889 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/pull/12860 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/fb69… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118760",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:03:36.414605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:03:50.453Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant\u0027s namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:35:05.192Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj"
},
{
"name": "https://github.com/kubeflow/pipelines/issues/9889",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/issues/9889"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/12860",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/12860"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
}
],
"source": {
"advisory": "GHSA-vjhf-6c8f-qhwj",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118760",
"datePublished": "2026-10-29T16:35:05.192Z",
"dateReserved": "2026-10-28T19:20:05.017Z",
"dateUpdated": "2026-11-03T16:03:50.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118759 (GCVE-0-2026-118759)
Vulnerability from cvelistv5 – Published: 2026-10-29 16:30 – Updated: 2026-10-30 17:13
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and suitable pod or node identifier can read live or archived logs with the API server's permissions. For live logs, the caller-controlled node ID was also accepted as a pod name without verifying that the pod belonged to the requested run, allowing a known run ID to select the namespace of an unrelated pod and read its main container logs. The handler does not authenticate requests itself, although an external authentication gate or network policy can limit reachability. Exposed logs can contain sensitive workload data or credentials. This issue is fixed in version 2.18.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:47 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13684 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/be47… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118759",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:47:06.206005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:13:29.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server\u0027s GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and suitable pod or node identifier can read live or archived logs with the API server\u0027s permissions. For live logs, the caller-controlled node ID was also accepted as a pod name without verifying that the pod belonged to the requested run, allowing a known run ID to select the namespace of an unrelated pod and read its main container logs. The handler does not authenticate requests itself, although an external authentication gate or network policy can limit reachability. Exposed logs can contain sensitive workload data or credentials. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:30:25.711Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13684",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13684"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/be4723e33727c6dad71a95cba61e8f61562ab20f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/be4723e33727c6dad71a95cba61e8f61562ab20f"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-wg5q-x4j9-qm54",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118759",
"datePublished": "2026-10-29T16:30:25.711Z",
"dateReserved": "2026-10-28T19:20:05.016Z",
"dateUpdated": "2026-10-30T17:13:29.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118758 (GCVE-0-2026-118758)
Vulnerability from cvelistv5 – Published: 2026-10-29 16:12 – Updated: 2026-10-29 20:18
VLAI
EPSS
VEX
Title
Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace's artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:18 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13677 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/4d9b… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/blob/2.18.0… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T20:18:21.704175Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:18:30.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify an existing mounted volume can use path traversal to read files outside that volume when the artifact-serving process can read them. The frontend pod serves the request when artifact proxying is disabled, while the selected namespace\u0027s artifact-service pod serves it when proxying is enabled. A deployment with authentication disabled requires no application credentials; in multi-user deployments, the caller ordinarily must be authorized for the supplied namespace. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T16:12:42.138Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2fg9-fx2f-439r"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13677",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13677"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f"
},
{
"name": "https://github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md#custom-storage-configuration-and-rollout",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/blob/2.18.0/docs/operator-guides/upgrade-2.18.md#custom-storage-configuration-and-rollout"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-2fg9-fx2f-439r",
"discovery": "UNKNOWN"
},
"title": "Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118758",
"datePublished": "2026-10-29T16:12:42.138Z",
"dateReserved": "2026-10-28T19:20:05.016Z",
"dateUpdated": "2026-10-29T20:18:30.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110220 (GCVE-0-2026-110220)
Vulnerability from cvelistv5 – Published: 2026-10-13 18:50 – Updated: 2026-10-26 18:31
VLAI
EPSS
VEX
Title
Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation
Summary
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 18:31 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflo… | third-party-advisory |
| https://github.com/kubeflow/hub/blob/v0.3.17/pkg/… | technical-description |
| https://github.com/kubeflow/hub/blob/v0.3.17/pkg/… | technical-description |
| https://github.com/kubeflow/hub/blob/v0.3.17/cmd/… | technical-description |
| https://github.com/kubeflow/hub | product |
| https://www.vulncheck.com/advisories/kubeflow-mod… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kubeflow | Model Registry |
Affected:
0 , ≤ 0.3.17
(semver)
|
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110220",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T18:31:25.083473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T18:31:35.835Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Model Registry",
"repo": "https://github.com/kubeflow/hub",
"vendor": "Kubeflow",
"versions": [
{
"lessThanOrEqual": "0.3.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants\u0027 InferenceServices cluster-wide."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:50:07.237Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.go#L268-L292"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.go#L420-L423"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go#L224-L228"
},
{
"tags": [
"product"
],
"url": "https://github.com/kubeflow/hub"
},
{
"name": "VulnCheck Advisory: Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kubeflow-model-registry-through-0.3.17-ssrf-via-inferenceservice-controller-url-annotation"
}
],
"title": "Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110220",
"datePublished": "2026-10-13T18:50:07.237Z",
"dateReserved": "2026-10-13T17:59:34.697Z",
"dateUpdated": "2026-10-26T18:31:35.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54745 (GCVE-0-2026-54745)
Vulnerability from cvelistv5 – Published: 2026-08-28 15:59 – Updated: 2026-08-31 19:10
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route remains outside the authorization middleware when ENABLE_AUTHZ=true and is reachable through /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, and /pipeline/apis/v2beta1/_proxy/, including through a crafted Referer header. Requests can forward attacker-controlled methods, headers such as Authorization, Cookie, and X-Forwarded-For, and POST bodies to reachable internal services, while returning the upstream response to the unauthenticated client. This can expose cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification. This issue is fixed in version 2.17.0.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 19:09 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/13511 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/a35f… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54745",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T19:09:39.730504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T19:10:06.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route remains outside the authorization middleware when ENABLE_AUTHZ=true and is reachable through /apis/v1beta1/_proxy/, /apis/v2beta1/_proxy/, /pipeline/apis/v1beta1/_proxy/, and /pipeline/apis/v2beta1/_proxy/, including through a crafted Referer header. Requests can forward attacker-controlled methods, headers such as Authorization, Cookie, and X-Forwarded-For, and POST bodies to reachable internal services, while returning the upstream response to the unauthenticated client. This can expose cloud metadata credentials, Kubernetes or service APIs, and other cluster-internal endpoints to unauthorized read or modification. This issue is fixed in version 2.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:59:01.118Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/13511",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/13511"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
}
],
"source": {
"advisory": "GHSA-gqww-5pj5-8fq7",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54745",
"datePublished": "2026-08-28T15:59:01.118Z",
"dateReserved": "2026-06-15T23:12:41.964Z",
"dateUpdated": "2026-08-31T19:10:06.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}