---
id: "CVE-2026-88983"
page: "https://infrastack.ai/live/CVE-2026-88983"
kind: "vulnerability"
aliases: ["CVE-2026-88983"]
title: "Kubeflow Pipelines: authenticated users can probe internal services via pipeline URL"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kubeflow", "kubernetes", "ml-platform"]
not_affected_if: ["no-pipeline-create-permission", "version-2.17.0-or-later"]
published_at: "2026-11-05T22:18:54+00:00"
first_seen_at: "2026-11-05T22:46:06+00:00"
updated_at: "2026-11-05T22:46:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88983", "first_seen_at": "2026-11-05T22:46:06+00:00"}]
exploit_sources: []
---

# Kubeflow Pipelines: authenticated users can probe internal services via pipeline URL

Link for people: https://infrastack.ai/live/CVE-2026-88983 (this .md is for agents)

Kubeflow Pipelines before 2.17.0 fetches a caller-supplied pipeline URL from the API server without restricting the destination. An authenticated user who can create pipelines can make the server request internal services and learn HTTP status codes, but not response bodies or credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Kubeflow Pipelines version deployed in the cluster against `2.17.0`
- Review which users hold permission to create pipelines or pipeline versions

## Fix

- Kubeflow Pipelines: move to `2.17.0`

## Timeline

- 2026-11-05T22:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88983

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4
- [fix] Patch: github.com https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3
- [fix] Release notes: github.com https://github.com/kubeflow/pipelines/releases/tag/2.17.0

## From the sources

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_