CVE-2026-88983

    Dashboard / Vulnerabilities / CVE-2026-88983

    CVE-2026-88983

    Published: 5 Nov 2026Last Modified: 8 Nov 2026

    Summary: Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation

    Details: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.

    References: https://github.com/kubeflow/pipelines/releases/tag/2.17.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88983.json, https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4, https://nvd.nist.gov/vuln/detail/CVE-2026-88983, https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3, https://github.com/kubeflow/pipelines/pull/12750

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4a3592cb2dd0a91a4652ab93893ec8beda1f3158

    Affected versions

    master-55ec846

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-88983 | CVE-DB