Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-88980— Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator

Quick assessment

Affected
kubeflow pipelines
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kubeflow Pipelines 允许用户构建和部署可移植、可扩展的机器学习工作流。在 2.18.0 版本之前，前端 GET /artifacts/get 路由会接受由调用者控制的 或 参数中的 bucket 和 key 值；而 函数允许全数字的十进制主机名，该主机名会被 URL 解析器转换为 IPv4 地址。默认的 配置以及未启用身份验证的独立部署模式，使得未认证的调用者能够获取内部 HTTP 资源并接收其响应体。在已启用身份验证的多租户配置中，拥有有效身份且被授权访问特定命名空间的低权限租户同样可利用此目标

CVSS 8.6 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88980

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator
Source: CVE Program / CVE List V5
Vulnerability Description
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
kubeflow pipelines < 2.18.0 -

II. Public POCs for CVE-2026-88980

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-88980

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-88980 (1)

Vendor Pages for CVE-2026-88980 (1)

Other References for CVE-2026-88980 (1)

Same Patch Batch · kubeflow · 2026-11-05 · 9 CVEs total

CVE-2026-77596 9.6 CRITICAL Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
CVE-2026-88981 8.6 HIGH Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints
CVE-2026-88984 7.2 HIGH Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delet
CVE-2026-88985 6.5 MEDIUM Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipeli
CVE-2026-88986 6.1 MEDIUM Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error respons
CVE-2026-88979 5.8 MEDIUM Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard p
CVE-2026-88982 5.4 MEDIUM Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a nam
CVE-2026-88983 5.0 MEDIUM Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validat

IV. Related Vulnerabilities

Same product: pipelines
Same vendor: kubeflow
Same weakness: CWE-918