{"id":"CVE-2026-88981","kind":"vulnerability","aliases":["CVE-2026-88981"],"related":[],"title":"Kubeflow Pipelines: unauthenticated requests make UI pod reach arbitrary hosts","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials. Multi-user secret-backed metadata remains restricted to the server namespace. This issue is fixed in version 2.18.0.","summary":"Kubeflow Pipelines before 2.18.0 lets an unauthenticated caller in the standalone, authorization-disabled setup make the shared ml-pipeline-ui pod connect to any reachable host and return the response data. Requests can also reveal an object-store access-key identifier when signed with the configured credentials.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubeflow-pipelines","kubernetes","ml-platform","runtime","self-hosted"],"not_affected_if":["authorization-enabled","multi-user-mode","version-2.18.0-or-later"],"how_to_check":"- Check the installed Kubeflow Pipelines version; anything below `2.18.0` is affected.\n- Check whether the standalone deployment runs with authorization disabled, since multi-user secret-backed metadata is stated to stay restricted.\n- Check whether the ml-pipeline-ui service is reachable from untrusted networks.","fix":"- Kubeflow Pipelines: upgrade to `2.18.0`.","status":"open","published_at":"2026-11-05T23:17:01+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","triaged_at":"2026-11-05T23:49:38+00:00","updated_at":"2026-11-05T23:49:38+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T23:49:38Z","model":"claude-haiku-5-5","output":{"fix":"- Kubeflow Pipelines: upgrade to `2.18.0`.","reach":"network","title":"Kubeflow Pipelines: unauthenticated requests make UI pod reach arbitrary hosts","impact":"medium","summary":"Kubeflow Pipelines before 2.18.0 lets an unauthenticated caller in the standalone, authorization-disabled setup make the shared ml-pipeline-ui pod connect to any reachable host and return the response data. Requests can also reveal an object-store access-key identifier when signed with the configured credentials.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["kubeflow-pipelines","kubernetes","ml-platform","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated internal requests and object-store access-key identifier exposure","analyst_note":"","how_to_check":"- Check the installed Kubeflow Pipelines version; anything below `2.18.0` is affected.\n- Check whether the standalone deployment runs with authorization disabled, since multi-user secret-backed metadata is stated to stay restricted.\n- Check whether the ml-pipeline-ui service is reachable from untrusted networks.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.18.0-or-later","multi-user-mode","authorization-enabled"],"who_is_affected":"Teams running Kubeflow Pipelines before 2.18.0 in the standalone configuration with authorization disabled are exposed, because the shared ml-pipeline-ui pod can be made to fetch arbitrary endpoints. Multi-user deployments are stated to keep secret-backed metadata restricted to the server namespace, and deployments with authorization enabled are not described as exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001304,"input_tokens":4428,"output_tokens":1723,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-88981':13A,16A '2.18.0':31B,94C,200C 'accept':106C,115C 'access':70B,170C 'access-key':69B,169C 'also':63B,166C 'arbitrari':9A,157C 'archiv':110C 'artifact':97C 'author':40B,139C 'authorization-dis':39B,138C 'back':186C 'build':84C 'caller':35B,145C 'compat':118C 'configur':77B,134C,142C,176C 'connect':51B,155C 'control':132C 'credenti':78B,180C 'cve':11A,14A 'data':60B,163C 'deploy':86C 'disabl':41B,140C 'download':98C 'enabl':81C 'endpoint':119C,127C 'fix':197C 'frontend':96C 'host':10A,27B,55B,159C 'identifi':72B,172C 'issu':195C 'key':71B,171C 'kubeflow':1A,18B,28B,79C 'kubeflow-pipelin':17B 'kubernet':20B 'learn':90C 'let':32B 'log':113C 'machin':89C 'make':5A,43B,147C 'match':129C 'may':165C 'metadata':120C,187C 'minio':105C 'ml':22B,47B,151C 'ml-pipeline-ui':46B,150C 'ml-platform':21B 'multi':182C 'multi-us':181C 'namespac':193C 'object':67B,178C 'object-stor':66B,177C 'oper':131C 'operator-control':130C 'path':99C,114C 'pipelin':2A,19B,29B,48B,80C,152C 'platform':23B 'pod':7A,50B,112C,154C 'pod-log':111C 'portabl':87C 'prior':92C 'providerinfo.params.endpoint':107C 'reach':8A 'reachabl':54B,158C 'remain':188C 'request':4A,61B,164C 'requir':125C 'respons':59B,162C 'restrict':189C 'return':57B,161C 'reveal':64B,167C 'runtim':24B 's3':102C,117C 's3-compatible':116C 'scalabl':88C 'secret':185C 'secret-back':184C 'self':26B 'self-host':25B 'server':192C 'setup':42B 'share':45B,149C 'ship':137C 'sign':74B,174C 'sourc':101C,104C 'standalon':38B,141C 'status':123C 'storag':133C 'store':68B,179C 'ui':6A,49B,153C 'unauthent':3A,34B,144C 'user':82C,183C 'version':199C 'without':124C 'workflow':91C,122C","nicknames":[],"mitigations":[],"who_affected":"Teams running Kubeflow Pipelines before 2.18.0 in the standalone configuration with authorization disabled are exposed, because the shared ml-pipeline-ui pod can be made to fetch arbitrary endpoints. Multi-user deployments are stated to keep secret-backed metadata restricted to the server namespace, and deployments with authorization enabled are not described as exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","kubeflowpipelines","kubernetes","mlplatform","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-28T03:53:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88981","severity":null,"published_at":"2026-11-05T23:17:01+00:00","modified_at":"2026-11-05T23:17:01+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","fetched_at":"2026-11-05T23:48:40+00:00","note":null}],"documents":[{"id":81494,"url":"https://github.com/kubeflow/pipelines/commit/0b77f9b07bfb9860dc90106003bbc3e2fe0e0965","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":26806,"url":"https://github.com/kubeflow/pipelines/releases/tag/2.18.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":81496,"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-3pcj-8j5w-jmxq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T03:53:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}