Security Flaw in Kubeflow Pipelines Affects User Data Protection

CVE-2026-88980

What is CVE-2026-88980?

A vulnerability in Kubeflow Pipelines allows an unauthenticated caller to exploit the GET /artifacts/get route, potentially accessing sensitive internal HTTP resources. The flaw results from improperly handled input parameters, enabling the retrieval of resource responses by leveraging caller-controlled bucket and key values. In configurations with valid authentication, low-privilege users can also exploit this issue within their namespaces. Although the vulnerability allows cloud credential disclosure via accessible metadata services and associated roles, it does not bypass IMDSv2 or gain credentials when these services are blocked. This security risk has been mitigated in version 2.18.0.

References