CVE-2026-88979
Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
| NVDNVD · Received | 3.1 | Medium5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- Not scored
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.
Weakness
Affected products
References (4)
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h (opens in a new tab)x_refsource_CONFIRM
- https://github.com/kubeflow/pipelines/pull/14346 (opens in a new tab)x_refsource_MISC
- https://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8 (opens in a new tab)x_refsource_MISC
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-88979)Record last updated .