Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-88983 Details

Description

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3	[email protected]
https://github.com/kubeflow/pipelines/pull/12750	[email protected]
https://github.com/kubeflow/pipelines/releases/tag/2.17.0	[email protected]
https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-441	Unintended Proxy or Intermediary ('Confused Deputy')	[email protected]
CWE-918	Server-Side Request Forgery (SSRF)	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes