CVE-2026-88981

Kubeflow artifact provider metadata controls outbound endpoints

Kubeflow · Kubeflow Pipelines S3/MinIO artifact and archived-log retrieval

First documented disclosure · Review checkpoint

Summary

A caller-selected storage endpoint can make the frontend request an internal host.

Severity and exploitation evidence

High · 8.6/10 · CVSS 3.1. Severity source.

Exploitation not established: The maintainer validates the request path and regression suite; live-cluster malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Artifact metadata and archived workflow-log metadata are used to construct storage clients without binding endpoints to operator configuration.

Conditions required

Reachable affected frontend; shipped standalone authorization-disabled configuration exposes the path without credentials.

Potential impact

Internal response disclosure and requests signed with configured storage credentials can expose an access-key identifier to an attacker’s endpoint.

Affected versions and configurations

KFP releases through 2.17.3.

Fix and mitigation status

2.18.0 binds endpoints, transport and credential scope to trusted configuration.

Practical next steps

Upgrade the frontend and all profile artifact receivers. Configure exact permitted origins, including scheme/port, and verify the deployed image and endpoint settings on every receiver.

Operating lesson

Keep storage destination selection separate from untrusted artifact metadata.

Evidence and limits

September 9 public fix; October 28 advisory/release; November 5 CVE. Endpoint restriction is separate from artifact-to-tenant ownership. Reconfiguring only the shared UI does not update old serving receivers.

Sources