Token Forgery Vulnerability in Kubeflow Pipelines by Google
CVE-2026-88979

5.8MEDIUM

Key Information:

Vendor

Kubeflow

Status
Pipelines
Vendor
CVE Published:
5 November 2026

What is CVE-2026-88979?

The TensorBoard proxy in Kubeflow Pipelines from version 2.17.0 until 2.18.0 is susceptible to a token forgery attack due to the use of MINIO_SECRET_KEY as its HMAC secret. With the default secret being publicly known, an unauthorized attacker can forge tokens with selected viewer names and namespaces in deployments lacking authorization. This vulnerability allows the attacker to construct requests to access sensitive TensorBoard resources. However, deployments where authorization is enabled continue to enforce necessary access checks, mitigating the potential impact in those environments. The issue has been resolved in version 2.18.0.

Affected Version(s)

pipelines >= 2.17.0, < 2.18.0

References

https://github.com/kubeflow/pipelines/security/advisories...
x_refsource_CONFIRM
https://github.com/kubeflow/pipelines/pull/14346
x_refsource_MISC
https://github.com/kubeflow/pipelines/commit/c8effaed6247...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.