---
id: "CVE-2026-88981"
page: "https://infrastack.ai/live/CVE-2026-88981"
kind: "vulnerability"
aliases: ["CVE-2026-88981"]
title: "Kubeflow Pipelines: unauthenticated requests make UI pod reach arbitrary hosts"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kubeflow-pipelines", "kubernetes", "ml-platform", "runtime", "self-hosted"]
not_affected_if: ["authorization-enabled", "multi-user-mode", "version-2.18.0-or-later"]
published_at: "2026-11-05T23:17:01+00:00"
first_seen_at: "2026-11-05T23:48:40+00:00"
updated_at: "2026-11-05T23:49:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88981", "first_seen_at": "2026-11-05T23:48:40+00:00"}]
exploit_sources: []
---

# Kubeflow Pipelines: unauthenticated requests make UI pod reach arbitrary hosts

Link for people: https://infrastack.ai/live/CVE-2026-88981 (this .md is for agents)

Kubeflow Pipelines before 2.18.0 lets an unauthenticated caller in the standalone, authorization-disabled setup make the shared ml-pipeline-ui pod connect to any reachable host and return the response data. Requests can also reveal an object-store access-key identifier when signed with the configured credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kubeflow Pipelines version; anything below `2.18.0` is affected.
- Check whether the standalone deployment runs with authorization disabled, since multi-user secret-backed metadata is stated to stay restricted.
- Check whether the ml-pipeline-ui service is reachable from untrusted networks.

## Fix

- Kubeflow Pipelines: upgrade to `2.18.0`.

## Timeline

- 2026-11-05T23:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88981

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kubeflow/pipelines/security/advisories/GHSA-3pcj-8j5w-jmxq
- [fix] Patch: github.com https://github.com/kubeflow/pipelines/commit/0b77f9b07bfb9860dc90106003bbc3e2fe0e0965
- [fix] Release: github.com https://github.com/kubeflow/pipelines/releases/tag/2.18.0

## From the sources

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials. Multi-user secret-backed metadata remains restricted to the server namespace. This issue is fixed in version 2.18.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_