Kubeflow Pipelines vulnerabilities

• kubeflow pipelines Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) CVE-2026-88982 Fix available 5.4 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines API server lacks authorization for shared pipeline uploads CVE-2026-77596 Fix available 9.6 CriticalNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints CVE-2026-88981 8.6 HighNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator CVE-2026-88980 8.6 HighNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy CVE-2026-88979 5.8 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines CVE-2026-88984 Fix available 7.2 HighNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses CVE-2026-88986 Fix available 6.1 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server CVE-2026-88985 Fix available 6.5 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation CVE-2026-88983 Fix available 5.0 MediumNovember 5, 2026
• kubeflow pipelines Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory CVE-2026-118761 Fix available 7.5 HighOctober 29, 2026
• kubeflow pipelines Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads CVE-2026-118760 6.5 MediumOctober 29, 2026
• kubeflow pipelines Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant CVE-2026-118759 Fix available 7.5 HighOctober 29, 2026
• kubeflow pipelines Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source CVE-2026-118758 7.5 HighOctober 29, 2026
• kubeflow pipelines Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true CVE-2026-54745 10.0 CriticalAugust 28, 2026
• kubeflow pipeline view, w pipeline view, pipelines +2 more Stored XSS in Kubeflow Pipeline View CVE-2024-9526 7.1 HighNovember 18, 2024