{"data":{"id":"a56d225f-1423-40ba-aff6-ea4ad06070e0","title":"CVE-2026-88979: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until…","summary":"Kubeflow Pipelines versions 2.17.0 through 2.18.0 use MINIO_SECRET_KEY as the HMAC secret for the TensorBoard proxy token, and that key's bundled default is publicly known. In deployments with authorization disabled that keep the default, an unauthenticated attacker can forge a token with a chosen viewerName and namespace and read responses from the matching TensorBoard service on port 80 under /tensorboard/<viewer>/. Resource-name validation and path-traversal rejection remain enforced, and the source does not establish unrestricted metadata access, writes, or service disruption.","solution":"This issue is fixed in version 2.18.0.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88979","publishedAt":"2026-11-05T23:17:01.110Z","cveId":"CVE-2026-88979","cweIds":["CWE-798","CWE-918"],"cvssScore":"5.8","cvssSeverity":"medium","severity":"medium","attackType":["jailbreak"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Kubeflow Pipelines","TensorBoard","MinIO"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Kubeflow Pipelines TensorBoard proxy forgeable token via default HMAC secret","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-06T06:09:43.489Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-06T06:09:48.069Z","patchAvailable":null,"disclosureDate":"2026-11-05T23:17:01.110Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0054"],"fixes":[]}}