CVE-2026-88983

Kubeflow pipeline URLs permit server-side request forgery

Kubeflow · Kubeflow Pipelines API server pipelineURL fetch

First documented disclosure · Review checkpoint

Summary

Pipeline creators can make the API server contact a caller-selected destination.

Severity and exploitation evidence

Medium · 5.0/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled external interactions and status differences were reported; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Pipeline/package URL fetches did not constrain hosts, resolved addresses or redirects.

Conditions required

Permission to create a pipeline or pipeline version and network reachability from the API server.

Potential impact

Blind SSRF and a limited response-status oracle. The report does not establish arbitrary body disclosure or metadata credential theft.

Affected versions and configurations

KFP versions before 2.17.0, per the CNA.

Fix and mitigation status

2.17.0 adds URL, DNS, redirect and connection-time validation.

Practical next steps

Upgrade, keep pipeline URL validation enabled and allow only trusted additional domains. Restrict API-server egress pending remediation.

Operating lesson

Revalidate destinations after DNS resolution and at every redirect.

Evidence and limits

January 31 public PR predates the September 14 advisory and November 5 CVE. A related report was submitted privately in 2023; that submission date is not treated as verified public disclosure. A metadata request returning 403 does not prove data access.

Sources