CVE-2026-88980

Kubeflow artifact fetching accepts decimal-encoded internal hosts

Kubeflow · Kubeflow Pipelines HTTP/HTTPS artifact source

First documented disclosure · Review checkpoint

Summary

A numeric host can bypass the bucket-name filter and return an internal HTTP response.

Severity and exploitation evidence

High · 8.6/10 · CVSS 3.1. Severity source.

Exploitation not established: The researcher demonstrated an internal canary response. Cloud metadata consequences remain deployment-dependent; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The name validator accepts a decimal integer that the URL parser interprets as IPv4; the default destination regex allows it.

Conditions required

Reachable frontend using affected direct artifact fetching; standalone defaults require no authentication, while multi-user operation requires an authorized identity/namespace.

Potential impact

Internal HTTP response disclosure; node-role credential exposure requires reachable IMDSv1 and an attached instance profile. IMDSv2-only access is not established.

Affected versions and configurations

KFP releases through 2.17.3; initial introduction is not established.

Fix and mitigation status

2.18.0 requires configured approved destinations and hardened path/redirect handling.

Practical next steps

Upgrade frontend, matching profile configuration and every artifact receiver. Configure trusted HTTP bases and verify receiver rollouts; updating only the shared UI is insufficient.

Operating lesson

Validate the parsed destination, not its spelling.

Evidence and limits

The July 8 public patch predates the October 28 advisory and November 5 CVE. Earlier direct-fetch reports did not establish this decimal-host bypass. The release does not claim to block all private addresses because approved internal stores may be legitimate.

Sources