CVE-2026-88985

Kubeflow pagination tokens can inject SQL identifiers

Kubeflow · Kubeflow Pipelines API server list endpoints

First documented disclosure · Review checkpoint

Summary

Client-controlled fields in a pagination token enter database query structure.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled authenticated database reads were documented; no malicious victim incident is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Base64 JSON tokens contain key/sort identifiers that reach SQL construction without adequate validation.

Conditions required

Ability to call an affected pipeline/run list API; multi-user deployments require the applicable authorization.

Potential impact

Database reads, potentially across namespaces, under the API database account. Arbitrary database writes were not demonstrated.

Affected versions and configurations

KFP versions before 2.17.0. Reported Kubeflow platform 1.7 is not a KFP component version boundary.

Fix and mitigation status

2.17.0 validates identifiers/filter keys and parameterizes metric-name joins.

Practical next steps

Upgrade API servers and review access to list endpoints. Treat pagination tokens as untrusted request data.

Operating lesson

Encoding client state does not make it trusted query structure.

Evidence and limits

The March 25 public fix predates the September 14 advisory and November 5 CNA. The original 2023 private submission and April 2026 related run-list report are consolidated; they are not separate vulnerabilities.

Sources