{"data":{"id":"c4fbc56e-a094-437a-bdf5-bc3173b9d8e2","title":"CVE-2026-88986: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0…","summary":"Kubeflow Pipelines versions prior to 2.15.0 have a flaw in the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events, where the podname and podnamespace query values and backend error details are included in HTML-capable error responses through frontend/server/k8s-helper.ts. An unauthenticated attacker can craft a link that runs JavaScript in the frontend origin when an authenticated user who meets the deployment's route-access requirements follows it. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established.","solution":"Fixed in version 2.15.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88986","publishedAt":"2026-11-05T22:18:54.743Z","cveId":"CVE-2026-88986","cweIds":["CWE-79"],"cvssScore":"6.1","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Kubeflow Pipelines"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-06T06:09:43.585Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-06T06:09:48.830Z","patchAvailable":null,"disclosureDate":"2026-11-05T22:18:54.743Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}