CVE-2026-88980 · Package
NO FIX YET · SEE WHAT TO DO
Kubeflow Pipelines before 2.18.0 lets a caller make the frontend fetch arbitrary internal HTTP resources through its artifact download route, because an all-digit decimal host is accepted and resolved to an internal IPv4 address. An attacker can read the response body, which may expose internal services and, where cloud metadata is reachable with attached roles, cloud credentials.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Kubeflow Pipelines before 2.18.0, both standalone with authorization disabled and multi-user with authenticated tenants. Exposure to credential theft depends on whether cloud metadata services are reachable and whether roles are attached to the nodes. Deployments already on 2.18.0 or later are not affected by this defect.
Not affected if metadata-blocked, version-2.18.0-or-later
Who cares kubeflow-pipelines, kubernetes, machine-learning, self-hosted
ml-pipeline-ui image tag or the Kubeflow manifest version, and see whether it is below 2.18.0.2.18.0 or later.Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.