CVE-2026-88985 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kubeflow Pipelines trusts SQL field names decoded from the base64 JSON page_token parameter when it builds list queries. An attacker who can call the list API can inject SQL through those fields and read data the API server database account can see across namespaces.
first public Sep 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Kubeflow Pipelines before 2.17.0 where users or workloads can call the pipeline or run list API. The exposure depends on the API server reaching a database account with data beyond one namespace. Teams on 2.17.0 or later are not affected by this issue.
Not affected if no-api-access, version-2.17.0-or-later
Who cares kubeflow, kubernetes, machine-learning, self-hosted
2.17.0 or later.Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.