---
id: "CVE-2026-88979"
page: "https://infrastack.ai/live/CVE-2026-88979"
kind: "vulnerability"
aliases: ["CVE-2026-88979"]
title: "Kubeflow Pipelines: forgeable TensorBoard proxy token exposes viewer responses"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["kubeflow-pipelines", "kubernetes", "machine-learning", "package"]
not_affected_if: ["authorization-enabled", "custom-minio-secret-key", "version-below-2.17.0"]
published_at: "2026-11-05T23:17:01+00:00"
first_seen_at: "2026-11-05T23:48:40+00:00"
updated_at: "2026-11-05T23:49:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88979", "first_seen_at": "2026-11-05T23:48:40+00:00"}]
exploit_sources: []
---

# Kubeflow Pipelines: forgeable TensorBoard proxy token exposes viewer responses

Link for people: https://infrastack.ai/live/CVE-2026-88979 (this .md is for agents)

Kubeflow Pipelines versions 2.17.0 through 2.18.0 sign the TensorBoard proxy token with the publicly known default MINIO_SECRET_KEY. An unauthenticated attacker in a deployment with authorization disabled can forge a token and read TensorBoard responses from chosen viewers in chosen namespaces.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Kubeflow Pipelines version deployed, expecting `2.17.0` to `2.18.0` to be affected.
- Check whether authorization is disabled in the deployment and whether MINIO_SECRET_KEY is still the bundled default.

## Fix

- Kubeflow Pipelines: move to `2.18.0`.

## Timeline

- 2026-11-05T23:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88979

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h
- [fix] Patch: github.com https://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8
- [fix] Release: github.com https://github.com/kubeflow/pipelines/releases/tag/2.18.0

## From the sources

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_