CVE-2026-88979 · Package
NO FIX YET · SEE WHAT TO DO
Kubeflow Pipelines versions 2.17.0 through 2.18.0 sign the TensorBoard proxy token with the publicly known default MINIO_SECRET_KEY. An unauthenticated attacker in a deployment with authorization disabled can forge a token and read TensorBoard responses from chosen viewers in chosen namespaces.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of Kubeflow Pipelines from 2.17.0 up to 2.18.0 that run with authorization disabled and the default MINIO_SECRET_KEY are exposed, since the forged token relies on that known secret. Authorization-enabled deployments still check namespace access, and deployments that have changed the secret or enabled authorization are not affected by this path.
Not affected if authorization-enabled, custom-minio-secret-key, version-below-2.17.0
Who cares kubeflow-pipelines, kubernetes, machine-learning
2.17.0 to 2.18.0 to be affected.2.18.0.Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.