Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-88985

Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server

Medium6.5
Published
Updated
Reserved
Assigned by
GitHub_M

Description

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0.

Scores

CVSS scores of CVE-2026-88985, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Received3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
Not scored

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Affected products

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-88985 badge
[![CVE-2026-88985](https://trackcve.app/badge/CVE-2026-88985.svg)](https://trackcve.app/cve/CVE-2026-88985)

Record last updated .