CVE-2026-88980: Kubeflow Pipelines artifact fetch flaw enables server-side request forgery

Summary

Prior to 2.18.0, Kubeflow Pipelines' frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. Under the default ALLOWED_ARTIFACT_DOMAIN_REGEX and the authorization-disabled standalone configuration, an unauthenticated caller can fetch internal HTTP resources and receive their response body, while in the authenticated multi-user configuration a low-privilege tenant with a valid identity and authorized namespace can reach the same defect.

Mitigation

Fixed in 2.18.0.

Related items

• MediumThreat actors use agentic AI tooling to find and abuse exposed secretsSimilar attack · Microsoft Security Blog
• CriticalCVE-2026-77596: Kubeflow Pipelines authorization bypass in pipeline upload endpointsSimilar attack · NVD/CVE Database
• HighCVE-2026-113663: AG2 SandboxShellTool command injection via newline separatorsSimilar attack · NVD/CVE Database
• MediumCVE-2026-88986: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0…Similar attack · NVD/CVE Database
• MediumCVE-2026-88985: Kubeflow Pipelines SQL injection through page_token list API fieldsSimilar attack · NVD/CVE Database