---
id: "CVE-2026-88980"
page: "https://infrastack.ai/live/CVE-2026-88980"
kind: "vulnerability"
aliases: ["CVE-2026-88980"]
title: "Kubeflow Pipelines: unauthenticated internal HTTP fetch via artifact download route"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["kubeflow-pipelines", "kubernetes", "machine-learning", "package", "self-hosted"]
not_affected_if: ["metadata-blocked", "version-2.18.0-or-later"]
published_at: "2026-11-05T23:17:01+00:00"
first_seen_at: "2026-11-05T23:48:40+00:00"
updated_at: "2026-11-05T23:49:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88980", "first_seen_at": "2026-11-05T23:48:40+00:00"}]
exploit_sources: []
---

# Kubeflow Pipelines: unauthenticated internal HTTP fetch via artifact download route

Link for people: https://infrastack.ai/live/CVE-2026-88980 (this .md is for agents)

Kubeflow Pipelines before 2.18.0 lets a caller make the frontend fetch arbitrary internal HTTP resources through its artifact download route, because an all-digit decimal host is accepted and resolved to an internal IPv4 address. An attacker can read the response body, which may expose internal services and, where cloud metadata is reachable with attached roles, cloud credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Kubeflow Pipelines version deployed, for example in the `ml-pipeline-ui` image tag or the Kubeflow manifest version, and see whether it is below `2.18.0`.
- Check whether the deployment runs in standalone mode with authorization disabled, which the sources describe as the default allowed-domain configuration case.
- Check whether the cluster or nodes expose a cloud metadata service reachable from the pipeline UI pod.

## Fix

- Kubeflow Pipelines: upgrade to `2.18.0` or later.

## Timeline

- 2026-11-05T23:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88980

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kubeflow/pipelines/security/advisories/GHSA-v3vh-xv5f-p4p4
- [fix] Patch: github.com https://github.com/kubeflow/pipelines/commit/4d9bc5ab12b67efedb3923ef428a399cb445cf5f
- [fix] Release: github.com https://github.com/kubeflow/pipelines/releases/tag/2.18.0

## From the sources

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_