CVE-2026-88983: falha de média gravidade em kubeflow pipelines
Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5epss 0.2%
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
kubeflow · pipelinesCVEs relacionadas — kubeflow pipelines
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54745CRITICALKubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=trueEPSS 0.6%CVE-2026-88980HIGHKubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validatorEPSS 0.6%CVE-2026-118758HIGHKubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact sourceEPSS 0.5%CVE-2026-118761HIGHKubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memoryEPSS 0.5%CVE-2026-118760MEDIUMKubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact readsEPSS 0.4%CVE-2026-118759HIGHKubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenantEPSS 0.3%