CVE-2026-88981

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials. Multi-user secret-backed metadata remains restricted to the server namespace. This issue is fixed in version 2.18.0.

• CWE-918

• https://github.com/kubeflow/pipelines/commit/0b77f9b07bfb9860dc90106003bbc3e2fe0e0965
• https://github.com/kubeflow/pipelines/pull/14349
• https://github.com/kubeflow/pipelines/releases/tag/2.18.0
• https://github.com/kubeflow/pipelines/security/advisories/GHSA-3pcj-8j5w-jmxq

Published

Nov 5, 2026

Last Modified

Nov 6, 2026

Status

Awaiting Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88975Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-88976Plate is a rich-text editor with AI and shadcn/ui. Prior to …6.1
• CVE-2026-88978Hatchet is a platform for orchestrating background tasks, AI…4.3
• CVE-2026-88979Kubeflow Pipelines enables users to build and deploy portabl…5.8
• CVE-2026-8898The Events In City plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-88980Kubeflow Pipelines enables users to build and deploy portabl…8.6
• CVE-2026-88982Kubeflow Pipelines enables users to build and deploy portabl…5.4
• CVE-2026-88983Kubeflow Pipelines enables users to build and deploy portabl…5
• CVE-2026-88984Kubeflow Pipelines enables users to build and deploy portabl…7.2
• CVE-2026-88985Kubeflow Pipelines enables users to build and deploy portabl…6.5
• CVE-2026-88986Kubeflow Pipelines enables users to build and deploy portabl…6.1
• CVE-2026-8899The Auto Thumbnail plugin for WordPress is vulnerable to Sto…6.4