{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88979", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-10T16:02:31.342Z", "datePublished": "2026-11-05T22:14:38.071Z", "dateUpdated": "2026-11-06T17:39:46.730Z"}, "containers": {"cna": {"title": "Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy", "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "lang": "en", "description": "CWE-798: Use of Hard-coded Credentials", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h"}, {"name": "https://github.com/kubeflow/pipelines/pull/14346", "tags": ["x_refsource_MISC"], "url": "https://github.com/kubeflow/pipelines/pull/14346"}, {"name": "https://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8", "tags": ["x_refsource_MISC"], "url": "https://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8"}, {"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"}], "affected": [{"vendor": "kubeflow", "product": "pipelines", "versions": [{"version": ">= 2.17.0, < 2.18.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:14:38.071Z"}, "descriptions": [{"lang": "en", "value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0."}], "source": {"advisory": "GHSA-j429-j7xw-8j9h", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T17:39:20.562426Z", "id": "CVE-2026-88979", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:39:46.730Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "pipelines", "vendor": "kubeflow", "versions": [{"status": "affected", "version": ">= 2.17.0, < 2.18.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0."}], "id": "CVE-2026-88979", "lastModified": "2026-11-06T18:18:21.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88979", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T17:39:20.562426Z", "version": "2.0.3"}}]}, "published": "2026-11-05T23:17:01.110", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8"}, {"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/pull/14346"}, {"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/kubeflow/pipelines: Kubeflow Pipelines: Information disclosure via default proxy signing key", "id": "2567962", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567962"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-1392", "details": ["A flaw was found in Kubeflow Pipelines. The TensorBoard proxy relies on a publicly known default secret key to sign authentication tokens. In deployments where authorization is disabled, an unauthenticated remote attacker can forge authentication tokens to query internal cluster services on port 80 and read their responses. This vulnerability leads to unauthorized information disclosure from internal network resources."], "mitigation": {"lang": "en:us", "value": "To mitigate this flaw:\n1. Enable authorization: Configure Kubeflow Pipelines to run with authorization enabled, ensuring that access to target namespaces is verified before requests are proxied.\n2. Replace default secrets: Supply a distinct, cryptographically strong value for the MINIO_SECRET_KEY environment variable or Kubernetes Secret rather than leaving the bundled default.\n3. Apply network controls: Deploy Kubernetes NetworkPolicies to restrict ingress traffic on port 80 for internal services, limiting connections solely to authorized application components.\nWarning: Modifying deployment environment variables or cluster secrets requires recreating or restarting the affected pods, which will cause a brief disruption to active pipeline workloads."}, "name": "CVE-2026-88979", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-api-server-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-driver-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-launcher-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-11-05T22:14:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88979\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88979\nhttps://github.com/kubeflow/pipelines/commit/c8effaed62476a8d8c99d3a6cfdd404a04ef99d8\nhttps://github.com/kubeflow/pipelines/pull/14346\nhttps://github.com/kubeflow/pipelines/releases/tag/2.18.0\nhttps://github.com/kubeflow/pipelines/security/advisories/GHSA-j429-j7xw-8j9h"], "statement": "This vulnerability is rated as Moderate impact because exploitation requires an authorization-disabled configuration using default signing keys, and the resulting exposure is restricted to read-only queries against specific internal services. In standard Red Hat OpenShift environments, cluster-level authorization and role-based access control are enabled by default, ensuring that namespace validation blocks unauthorized access. Furthermore, built-in validation controls limit destination endpoints and reject directory traversal attempts, preventing broader network access or modification of cluster resources.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.17.0,2.18.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pipelines", "source": "cna", "vendor": "kubeflow"}, "product": "pipelines", "vendor": "kubeflow"}], "created": "2026-11-05T23:45:07.425775+00:00", "updated": "2026-11-06T15:00:07.993361+00:00", "vendors": ["kubeflow", "kubeflow$PRODUCT$pipelines"]}