{"id":"CVE-2026-88983","kind":"vulnerability","aliases":["CVE-2026-88983"],"related":[],"title":"Kubeflow Pipelines: authenticated users can probe internal services via pipeline URL","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.","summary":"Kubeflow Pipelines before 2.17.0 fetches a caller-supplied pipeline URL from the API server without restricting the destination. An authenticated user who can create pipelines can make the server request internal services and learn HTTP status codes, but not response bodies or credentials.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubeflow","kubernetes","ml-platform"],"not_affected_if":["no-pipeline-create-permission","version-2.17.0-or-later"],"how_to_check":"- Check the Kubeflow Pipelines version deployed in the cluster against `2.17.0`\n- Review which users hold permission to create pipelines or pipeline versions","fix":"- Kubeflow Pipelines: move to `2.17.0`","status":"open","published_at":"2026-11-05T22:18:54+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","triaged_at":"2026-11-05T22:46:44+00:00","updated_at":"2026-11-05T22:46:44+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T22:46:44Z","model":"claude-haiku-5-5","output":{"fix":"- Kubeflow Pipelines: move to `2.17.0`","reach":"network","title":"Kubeflow Pipelines: authenticated users can probe internal services via pipeline URL","impact":"low","summary":"Kubeflow Pipelines before 2.17.0 fetches a caller-supplied pipeline URL from the API server without restricting the destination. An authenticated user who can create pipelines can make the server request internal services and learn HTTP status codes, but not response bodies or credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubeflow","kubernetes","ml-platform"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"internal services probed; status codes observed, no response bodies","analyst_note":"","how_to_check":"- Check the Kubeflow Pipelines version deployed in the cluster against `2.17.0`\n- Review which users hold permission to create pipelines or pipeline versions","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.17.0-or-later","no-pipeline-create-permission"],"who_is_affected":"Teams running Kubeflow Pipelines before 2.17.0 where users can create pipelines or pipeline versions. The API server's outbound fetch of the pipeline URL is what reaches internal services, so exposure depends on who holds create permission. Teams on 2.17.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4347,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-88983':14A,17A '2.17.0':27B,83C,156C 'api':37B,85C,122C 'arbitrari':135C 'authent':3A,44B,106C 'avail':145C 'bodi':65B,138C 'build':73C 'caller':31B,98C,107C 'caller-suppli':30B,97C 'code':61B,133C 'creat':48B,111C 'creation':93C 'credenti':67B,140C 'cve':12A,15A 'deploy':75C 'destin':42B,104C 'disclosur':139C 'enabl':70C 'establish':149C 'fetch':28B,95C 'fix':153C 'http':59B 'impact':146C 'infrastructur':18B 'integr':143C 'intern':7A,55B,125C 'issu':151C 'kubeflow':1A,19B,24B,68C 'kubernet':20B 'learn':58B,79C 'limit':130C 'machin':78C 'make':51B,118C 'ml':22B 'ml-platform':21B 'observ':128C 'oracl':134C 'path':94C 'permiss':109C 'pipelin':2A,10A,25B,33B,49B,69C,88C,91C,113C,115C 'pipeline-vers':90C 'pipelineurl':100C 'platform':23B 'portabl':76C 'prior':81C 'probe':6A 'request':54B,119C 'respons':64B,137C 'response-bodi':136C 'restrict':40B,102C 'scalabl':77C 'server':38B,53B,86C,123C 'servic':8A,56B,126C 'status':60B,132C 'status-cod':131C 'suppli':32B,99C 'theft':141C 'url':11A,34B 'user':4A,45B,71C 'version':92C,116C,155C 'via':9A 'without':39B,101C 'workflow':80C","nicknames":[],"mitigations":[],"who_affected":"Teams running Kubeflow Pipelines before 2.17.0 where users can create pipelines or pipeline versions. The API server's outbound fetch of the pipeline URL is what reaches internal services, so exposure depends on who holds create permission. Teams on 2.17.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","kubeflow","kubernetes","medium","mlplatform"],"campaign_type":null,"first_public_at":"2026-09-14T23:27:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88983","severity":null,"published_at":"2026-11-05T22:18:54+00:00","modified_at":"2026-11-05T22:18:54+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","fetched_at":"2026-11-05T22:46:06+00:00","note":null}],"documents":[{"id":81026,"url":"https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":49211,"url":"https://github.com/kubeflow/pipelines/releases/tag/2.17.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":81028,"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-14T23:27:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}