DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88983: CVE-2026-88983: Authenticated Server-Side Request Forgery in Kubeflow Pipelines API Server

#security #cve #cybersecurity

CVE-2026-88983: Authenticated Server-Side Request Forgery in Kubeflow Pipelines API Server

Vulnerability ID: CVE-2026-88983
CVSS Score: 5.0
Published: 2026-11-09

CVE-2026-88983 is an authenticated Server-Side Request Forgery (SSRF) vulnerability affecting the Kubeflow Pipelines API server in versions prior to 2.17.0. When an authenticated user creates a pipeline or pipeline version using a remote specification URI, the backend server retrieves the document via Go's default HTTP client without validating the target scheme, hostname, port, or IP address. Because the API server reflects remote connection errors and HTTP status codes in its response, an attacker with pipeline creation permissions can exploit the server as a status-code and port-scanning oracle against Kubernetes cluster-internal services, private networks, and cloud metadata endpoints.

TL;DR

An authenticated Server-Side Request Forgery (SSRF) vulnerability in Kubeflow Pipelines prior to 2.17.0 allows attackers with pipeline creation privileges to probe internal cluster services, RFC 1918 networks, and cloud metadata endpoints via unvalidated pipeline specification URLs.

⚠️ Exploit Status: POC

Technical Details

  • CVE ID: CVE-2026-88983 (GHSA-f7vj-6669-qvv4)
  • Weakness Class: CWE-918 (Server-Side Request Forgery) / CWE-441 (Confused Deputy)
  • Attack Vector: Network (Authenticated REST/gRPC API request)
  • CVSS v3.1 Score: 5.0 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
  • EPSS Score: 0.20% (9.82nd Percentile)
  • Primary Impact: Internal Kubernetes service/port scanning and HTTP status-code oracle
  • Patched Version: Kubeflow Pipelines 2.17.0
  • CISA KEV Status: Not Listed

Affected Systems

  • Kubeflow Pipelines (kubeflow/pipelines) < 2.17.0
  • Kubeflow Pipelines: < 2.17.0 (Fixed in: 2.17.0)

Code Analysis

Commit: 504d779

Introduce pipeline URL validation, domain allowlist, CIDR blocklist, and SafePipelineHTTPClient to prevent SSRF in pipeline creation endpoints.

Mitigation Strategies

  • Upgrade Kubeflow Pipelines to version 2.17.0 or later to enforce strict URL scheme, port, domain allowlist, and socket-level IP validation.
  • Maintain default secure environment variables on the ml-pipeline API server (PIPELINE_URL_VALIDATION_ENABLED=true, PIPELINE_URL_ALLOW_HTTP=false).
  • Restrict outbound network connectivity from the ml-pipeline API server pod using Kubernetes egress NetworkPolicies to block access to link-local metadata services (169.254.0.0/16) and unrequired internal subnets.
  • Enforce principle of least privilege via Kubernetes and Kubeflow RBAC so only trusted users and service accounts have permissions to create pipelines or pipeline versions.

Remediation Steps:

  1. Identify the currently deployed version of Kubeflow Pipelines in the cluster (check the container image tag on the ml-pipeline deployment in the kubeflow namespace).
  2. Update the Kubeflow Pipelines deployment manifests or Kustomize overlays to reference release v2.17.0 (https://github.com/kubeflow/pipelines/releases/tag/2.17.0).
  3. If internal object storage or Git repositories are used to host pipeline YAML/archive specs, configure the PIPELINE_URL_ALLOWED_DOMAINS environment variable on the ml-pipeline deployment with the specific trusted hostnames.
  4. Apply Kubernetes egress NetworkPolicies to prevent the API server pod from communicating with 169.254.169.254 and unauthorized internal cluster services.
  5. Verify the remediation by attempting to register a pipeline pointing to a loopback or internal cluster URL and confirming it is rejected prior to network dial.

References

Read the full report for CVE-2026-88983 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)