CVE-2026-88985

In Kubeflow Pipelines prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated user can modify or delete shared pipeline definitions and versions without the required Kubernetes RBAC permissions, compromising their integrity and availability.

In Kubeflow Pipelines prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash select template fields without the Kubernetes namespace and trust the mutable execution_cache_key annotation. In multi-user deployments sharing the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs substituted into a later step.

In Kubeflow Pipelines prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials.

In Kubeflow Pipelines prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body.

In Kubeflow Pipelines from 2.17.0 until 2.18.0, the TensorBoard proxy token uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token with a chosen viewerName and namespace.

In Kubeflow Pipelines prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user meeting the deployment's authentication and route-access requirements follows it. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established.

In Kubeflow Pipelines prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established.

In Kubeflow Pipelines prior to 2.18.0, the multi-user HTTP endpoints for uploading pipelines and pipeline versions skip SubjectAccessReview when the target namespace is empty and REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission. If the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass.

Kubeflow Pipelines before version 2.17.0 has an unauthenticated SSRF vulnerability in the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route is accessible without authorization, allowing requests to be forwarded to internal services and responses returned to the attacker. This issue is fixed in version 2.17.0.

In Kubeflow Pipelines prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. This is fixed in version 2.18.0.