CVE-2026-88980: Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWEDARTIFACTDOMAINREGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kubeflow Pipelinesto a version that resolves this vulnerability.Fixed in 2.18.0
Event History
Frequently Asked Questions
Which deployments are exposed without authentication?
Authorization-disabled standalone deployments using the default ALLOWED_ARTIFACT_DOMAIN_REGEX can be accessed by an unauthenticated caller through the frontend GET /artifacts/get route.
Can authenticated multi-user deployments also be affected?
Yes. In authenticated multi-user configurations, a low-privilege tenant with a valid identity and an authorized namespace can reach the destination-validation defect.
What does an attacker need to exploit the issue?
The attacker needs to send a request to GET /artifacts/get using source=http or source=https and caller-controlled bucket and key values. An all-digit decimal hostname can bypass the bucket validator because the URL parser converts it to an IPv4 address.
Are cloud credentials necessarily exposed?
No. Credential disclosure depends on whether a reachable metadata service is available and on the roles attached to it; the issue does not establish an IMDSv2 bypass or credential access when metadata services are blocked.
What version fixes the vulnerability?
Upgrade Kubeflow Pipelines to version 2.18.0, which fixes the issue.