Bug 2567952 (CVE-2026-88985) - CVE-2026-88985 github.com/kubeflow/pipelines: Kubeflow Pipelines: Information disclosure via SQL injection in pagination token handling
Summary: CVE-2026-88985 github.com/kubeflow/pipelines: Kubeflow Pipelines: Information...
Keywords:
Status: NEW
Alias: CVE-2026-88985
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-05 22:41 UTC by OSIDB Bzimport
Modified: 2026-11-06 02:52 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-05 22:41:36 UTC 
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0.
Note You need to log in before you can comment on or make changes to this bug.