Kubeflow vulnerabilities

Products

• Pipelines 15
• Kubeflow 3
• Kubeflow/kubeflow 3

Newest

• kubeflow pipelines Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) CVE-2026-88982 5.4 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines API server lacks authorization for shared pipeline uploads CVE-2026-77596 9.6 CriticalNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints CVE-2026-88981 8.6 HighNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator CVE-2026-88980 8.6 HighNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy CVE-2026-88979 5.8 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines CVE-2026-88984 7.2 HighNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses CVE-2026-88986 6.1 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server CVE-2026-88985 6.5 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation CVE-2026-88983 5.0 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory CVE-2026-118761 Fix available 7.5 HighOctober 29, 2026
• kubeflow pipelines Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads CVE-2026-118760 6.5 MediumOctober 29, 2026
• kubeflow pipelines Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant CVE-2026-118759 Fix available 7.5 HighOctober 29, 2026
• kubeflow pipelines Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source CVE-2026-118758 7.5 HighOctober 29, 2026
• kubeflow model registry Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation CVE-2026-110220 7.1 HighOctober 13, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true CVE-2026-54745 10.0 CriticalAugust 28, 2026
• kubeflow community-distribution Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing CVE-2026-47237 8.0 HighJuly 21, 2026
• kubeflow pipeline view, w pipeline view, pipelines +2 more Stored XSS in Kubeflow Pipeline View CVE-2024-9526 7.1 HighNovember 18, 2024
• kubeflow, kubeflow kubeflow/kubeflow +1 more ReDoS in kubeflow/kubeflow CVE-2024-5552 7.5 HighJune 6, 2024
• kubeflow, kubeflow kubeflow/kubeflow +1 more Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow CVE-2023-6571 5.4 MediumDecember 14, 2023
• kubeflow, kubeflow kubeflow/kubeflow +1 more Server-Side Request Forgery (SSRF) in kubeflow/kubeflow CVE-2023-6570 7.7 HighDecember 14, 2023