{"data":{"id":"53f5e544-ffc2-4720-9abf-8a82d532e6f1","title":"CVE-2026-88985: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0…","summary":"CVE-2026-88985 affects Kubeflow Pipelines before 2.17.0. The API server trusts SQL identifier fields (KeyFieldName, SortByFieldName) decoded from the base64-encoded JSON page_token parameter before building list queries, including v1beta1 and v2beta1 run-listing metric paths. An attacker who can invoke an affected pipeline or run list API can inject into these fields and read data available to the API server database account across namespaces; database modification is not established.","solution":"Fixed in 2.17.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88985","publishedAt":"2026-11-05T22:18:54.587Z","cveId":"CVE-2026-88985","cweIds":["CWE-89"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Kubeflow Pipelines"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Kubeflow Pipelines SQL injection through page_token list API fields","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-06T06:09:43.578Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-06T06:09:49.072Z","patchAvailable":null,"disclosureDate":"2026-11-05T22:18:54.587Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-66"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}