kubeflow vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20242
3. 202616

Newest CVEs

• CVE-2026-88982

  Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)

  kubeflow · pipelines

  Medium5.4
• CVE-2026-77596

  Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

  kubeflow · pipelines

  Critical9.6
• CVE-2026-88981

  Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints

  kubeflow · pipelines

  High8.6
• CVE-2026-88980

  Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator

  kubeflow · pipelines

  High8.6
• CVE-2026-88979

  Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy

  kubeflow · pipelines

  Medium5.8
• CVE-2026-88984

  Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines

  kubeflow · pipelines

  High7.2
• CVE-2026-88986

  Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses

  kubeflow · pipelines

  Medium6.1
• CVE-2026-88985

  Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server

  kubeflow · pipelines

  Medium6.5
• CVE-2026-88983

  Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation

  kubeflow · pipelines

  Medium5.0
• CVE-2026-118761

  Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

  kubeflow · pipelines

  High7.5