GHSA-R4MX-2GR2-8277
Vulnerability from github – Published: 2026-11-09 23:25 – Updated: 2026-11-09 23:25Summary
Kubeflow Pipelines API server does not sufficiently validate SQL identifier fields decoded from the page_token pagination parameter. Client-controlled fields can reach SQL query construction, allowing SQL injection through list APIs.
This advisory consolidates the original pipeline-listing report and the later run-listing report in GHSA-mhpc-2x8q-2vp9. Their contributions and chronology are distinguished below.
Impact and prerequisites
An attacker able to invoke an affected list API may read data accessible to the API server's database account, including data belonging to other namespaces. The original report demonstrated database read access through an authenticated Kubeflow deployment.
Authentication and authorization requirements depend on deployment configuration. In multi-user deployments, the attacker must pass the applicable endpoint authorization checks. A single-user deployment that exposes the API without an authentication layer may be reachable without credentials.
The submitted evidence establishes a confidentiality issue. Database modification was not demonstrated; this advisory does not claim arbitrary database writes.
Technical details
Pagination tokens are base64-encoded JSON, not trusted server-side state. Before the fix, token deserialization accepted structural fields such as key and sort identifiers without sufficient validation before SQL construction.
The reports describe complementary paths through this defect:
- Pipeline listing: the original report demonstrated injection through
KeyFieldName. - Run listing: the later report documented
SortByFieldNamereaching query construction in both the v1beta1 and v2beta1 APIs, including metric joins, selected column aliases, ordering, and column propagation through resource-reference and task joins.
These paths share the unvalidated pagination-token boundary. Review of the later report and its discussion identified no reported path left unresolved by the merged fix.
Remediation
Upgrade the Kubeflow Pipelines API server to 2.17.0 or later.
PR #13127, included in 2.17.0, validates token identifiers and filter keys before query construction. It also separates user-facing metric names from SQL identifiers, uses a fixed metric-column alias, and parameterizes the metric-name join condition.
The PR additionally addresses first-page metric sorting without a pagination token. That additional protection is part of the remediation; the duplicate determination here concerns the page-token claims actually submitted in the two reports, not merely their inclusion in the same PR.
The original report identified its deployment as Kubeflow 1.7, which should not be interpreted as a verified Kubeflow Pipelines component-version boundary. The later report identified KFP 2.16.0. These are reported affected environments, not an established introduction version.
Attribution and report history
- @phisch1991 and @k0rti: credited reporters of the original pipeline-listing SQL injection submitted on December 13, 2023.
- BugBunny.ai (@bugbunny-research): submitted the later report on April 1, 2026, documenting the run-listing and metric-query paths in GHSA-mhpc-2x8q-2vp9. This acknowledges that specific contribution without implying authorship of the 2023 report.
- Cyber Nagle: authored the merged remediation in PR #13127.
GHSA-mhpc-2x8q-2vp9 is consolidated here for vulnerability tracking. Its submission and reporter credit remain preserved on that advisory; closure as a duplicate does not characterize the report as invalid.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/kubeflow/pipelines"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260403210607-ac3a4c65677a"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-88985"
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2026-11-09T23:25:00Z",
"nvd_published_at": "2026-11-05T22:18:54Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nKubeflow Pipelines API server does not sufficiently validate SQL identifier fields decoded from the `page_token` pagination parameter. Client-controlled fields can reach SQL query construction, allowing SQL injection through list APIs.\n\nThis advisory consolidates the original pipeline-listing report and the later run-listing report in [GHSA-mhpc-2x8q-2vp9](https://github.com/kubeflow/pipelines/security/advisories/GHSA-mhpc-2x8q-2vp9). Their contributions and chronology are distinguished below.\n\n## Impact and prerequisites\n\nAn attacker able to invoke an affected list API may read data accessible to the API server\u0027s database account, including data belonging to other namespaces. The original report demonstrated database read access through an authenticated Kubeflow deployment.\n\nAuthentication and authorization requirements depend on deployment configuration. In multi-user deployments, the attacker must pass the applicable endpoint authorization checks. A single-user deployment that exposes the API without an authentication layer may be reachable without credentials.\n\nThe submitted evidence establishes a confidentiality issue. Database modification was not demonstrated; this advisory does not claim arbitrary database writes.\n\n## Technical details\n\nPagination tokens are base64-encoded JSON, not trusted server-side state. Before the fix, token deserialization accepted structural fields such as key and sort identifiers without sufficient validation before SQL construction.\n\nThe reports describe complementary paths through this defect:\n\n- **Pipeline listing:** the original report demonstrated injection through `KeyFieldName`.\n- **Run listing:** the later report documented `SortByFieldName` reaching query construction in both the v1beta1 and v2beta1 APIs, including metric joins, selected column aliases, ordering, and column propagation through resource-reference and task joins.\n\nThese paths share the unvalidated pagination-token boundary. Review of the later report and its discussion identified no reported path left unresolved by the merged fix.\n\n## Remediation\n\nUpgrade the Kubeflow Pipelines API server to **2.17.0 or later**.\n\n[PR #13127](https://github.com/kubeflow/pipelines/pull/13127), included in 2.17.0, validates token identifiers and filter keys before query construction. It also separates user-facing metric names from SQL identifiers, uses a fixed metric-column alias, and parameterizes the metric-name join condition.\n\nThe PR additionally addresses first-page metric sorting without a pagination token. That additional protection is part of the remediation; the duplicate determination here concerns the page-token claims actually submitted in the two reports, not merely their inclusion in the same PR.\n\nThe original report identified its deployment as **Kubeflow 1.7**, which should not be interpreted as a verified Kubeflow Pipelines component-version boundary. The later report identified **KFP 2.16.0**. These are reported affected environments, not an established introduction version.\n\n## Attribution and report history\n\n- **@phisch1991 and @k0rti:** credited reporters of the original pipeline-listing SQL injection submitted on December 13, 2023.\n- **BugBunny.ai (@bugbunny-research):** submitted the later report on April 1, 2026, documenting the run-listing and metric-query paths in GHSA-mhpc-2x8q-2vp9. This acknowledges that specific contribution without implying authorship of the 2023 report.\n- **Cyber Nagle:** authored the merged remediation in PR #13127.\n\nGHSA-mhpc-2x8q-2vp9 is consolidated here for vulnerability tracking. Its submission and reporter credit remain preserved on that advisory; closure as a duplicate does not characterize the report as invalid.",
"id": "GHSA-r4mx-2gr2-8277",
"modified": "2026-11-09T23:25:00Z",
"published": "2026-11-09T23:25:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-r4mx-2gr2-8277"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88985"
},
{
"type": "WEB",
"url": "https://github.com/kubeflow/pipelines/pull/13127"
},
{
"type": "WEB",
"url": "https://github.com/kubeflow/pipelines/commit/ac3a4c65677a3bc7a3d5b1e264fba41178d4ab32"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubeflow/pipelines"
},
{
"type": "WEB",
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.