{"id":"CVE-2026-88985","kind":"vulnerability","aliases":["CVE-2026-88985"],"related":[],"title":"Kubeflow Pipelines: forged page tokens let callers read the API database","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0.","summary":"Kubeflow Pipelines trusts SQL field names decoded from the base64 JSON page_token parameter when it builds list queries. An attacker who can call the list API can inject SQL through those fields and read data the API server database account can see across namespaces.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubeflow","kubernetes","machine-learning","self-hosted"],"not_affected_if":["no-api-access","version-2.17.0-or-later"],"how_to_check":"- Check the Kubeflow Pipelines version deployed, for example the API server image tag, and compare it with the fixed version.\n- Confirm whether an attacker can reach the pipeline or run list API from outside the cluster or from other namespaces.","fix":"- Kubeflow Pipelines: move to `2.17.0` or later.","status":"open","published_at":"2026-11-05T22:18:54+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","triaged_at":"2026-11-05T22:46:40+00:00","updated_at":"2026-11-05T22:46:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-05T22:46:40Z","model":"claude-haiku-5-5","output":{"fix":"- Kubeflow Pipelines: move to `2.17.0` or later.","reach":"network","title":"Kubeflow Pipelines: forged page tokens let callers read the API database","impact":"medium","summary":"Kubeflow Pipelines trusts SQL field names decoded from the base64 JSON page_token parameter when it builds list queries. An attacker who can call the list API can inject SQL through those fields and read data the API server database account can see across namespaces.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubeflow","kubernetes","machine-learning","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads database data across namespaces via list queries","analyst_note":"","how_to_check":"- Check the Kubeflow Pipelines version deployed, for example the API server image tag, and compare it with the fixed version.\n- Confirm whether an attacker can reach the pipeline or run list API from outside the cluster or from other namespaces.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.17.0-or-later","no-api-access"],"who_is_affected":"Teams running Kubeflow Pipelines before 2.17.0 where users or workloads can call the pipeline or run list API. The exposure depends on the API server reaching a database account with data beyond one namespace. Teams on 2.17.0 or later are not affected by this issue.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":4355,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-88985':14A,17A '2.17.0':87C,160C 'account':67B,146C 'across':70B,147C 'affect':116C 'api':10A,53B,64B,89C,121C,143C 'attack':47B,111C 'avail':140C 'base64':36B,100C 'base64-encoded':99C 'build':43B,77C 'call':50B 'caller':7A 'construct':107C 'cve':12A,15A 'data':62B,139C 'databas':11A,66B,145C,149C 'decod':33B,96C 'deploy':79C 'enabl':74C 'encod':101C 'establish':153C 'field':31B,59B,95C 'fix':157C 'forg':3A 'host':26B 'identifi':94C 'includ':128C 'infrastructur':18B 'inject':55B,123C 'invok':114C 'issu':155C 'json':37B,102C 'keyfieldnam':125C 'kubeflow':1A,19B,27B,72C 'kubernet':20B 'learn':23B,83C 'let':6A 'list':44B,52B,108C,120C,134C 'machin':22B,82C 'machine-learn':21B 'metric':135C 'modif':150C 'name':32B 'namespac':71B,148C 'page':4A,38B,103C 'paramet':40B,105C 'path':136C 'pipelin':2A,28B,73C,117C 'portabl':80C 'prior':85C 'queri':45B,109C 'read':8A,61B,138C 'run':119C,133C 'run-list':132C 'scalabl':81C 'see':69B 'self':25B 'self-host':24B 'server':65B,90C,144C 'sortbyfieldnam':127C 'sql':30B,56B,93C 'structur':92C 'token':5A,39B,104C 'trust':29B,91C 'user':75C 'v1beta1':129C 'v2beta1':131C 'version':159C 'workflow':84C","nicknames":[],"mitigations":[],"who_affected":"Teams running Kubeflow Pipelines before 2.17.0 where users or workloads can call the pipeline or run list API. The exposure depends on the API server reaching a database account with data beyond one namespace. Teams on 2.17.0 or later are not affected by this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","kubeflow","kubernetes","machinelearning","medium","selfhosted"],"campaign_type":null,"first_public_at":"2026-09-14T23:31:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88985","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88985","severity":null,"published_at":"2026-11-05T22:18:54+00:00","modified_at":"2026-11-05T22:18:54+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","fetched_at":"2026-11-05T22:46:06+00:00","note":null}],"documents":[{"id":81029,"url":"https://github.com/kubeflow/pipelines/commit/ac3a4c65677a3bc7a3d5b1e264fba41178d4ab32","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":49211,"url":"https://github.com/kubeflow/pipelines/releases/tag/2.17.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":81031,"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-r4mx-2gr2-8277","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-14T23:31:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}