SQL Injection Vulnerability in Kubeflow Pipelines API Server

CVE-2026-88985

What is CVE-2026-88985?

A SQL injection vulnerability exists in Kubeflow Pipelines, where the API server improperly trusts structural SQL identifier fields that are decoded from the base64-encoded JSON page_token parameter. This flaw allows an attacker to exploit affected pipeline or run list APIs by injecting arbitrary identifiers or sort fields, including those from v1beta1 and v2beta1 run-listing metrics. Consequently, an attacker may gain unauthorized access to sensitive data stored in the API server's database across various namespaces. This issue has been resolved in version 2.17.0.

References