CVE-2026-88980 in Pipelines
Summary
by MITRE • 11/06/2026
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/06/2026
Kubeflow Pipelines serves as a critical infrastructure for orchestrating machine learning workflows, yet prior to version 2.18.0 it contained a significant server-side request forgery vulnerability within its artifact retrieval mechanism. The frontend endpoint GET /artifacts/get was designed to fetch artifacts from external storage buckets but suffered from insufficient validation of the source URL parameters. Specifically, the application accepted both HTTP and HTTPS schemes with caller-controlled bucket and key values without adequately restricting internal network access. This flaw allowed attackers to manipulate the destination address by exploiting a parsing inconsistency where an all-digit decimal host string was interpreted as an IPv4 address rather than being rejected or validated against a safe allowlist.
The technical root cause lies in how the application processed hostname inputs alongside its default configuration settings. The regular expression ALLOWED_ARTIFACT_DOMAIN_REGEX, when combined with the authorization-disabled standalone mode of operation, permitted unauthenticated users to target internal HTTP resources. Even in authenticated multi-user configurations where identity verification is enforced, a low-privilege tenant possessing valid credentials and access to an authorized namespace could exploit this destination-validation defect. By constructing URLs that leverage decimal IP representations or other bypass techniques, attackers could redirect requests toward internal services that are not intended for public exposure, effectively turning the artifact fetcher into a proxy for accessing restricted network segments.
The operational impact of this vulnerability centers on cloud credential disclosure and lateral movement within private networks. If the target environment exposes metadata services such as AWS Instance Metadata Service or Azure Managed Identity endpoints, an attacker can retrieve sensitive authentication tokens and configuration data attached to those instances. This information can then be used to escalate privileges or access other resources within the cloud provider account. However it is important to note that this vulnerability does not constitute a bypass of IMDSv2 token requirements nor does it guarantee credential access if metadata services are properly blocked from external network paths. The severity therefore depends heavily on the specific deployment architecture and whether internal endpoints are reachable from the compromised Kubeflow instance.
To mitigate this risk, organizations must upgrade to version 2.18.0 or later where the destination validation logic has been corrected to prevent these parsing anomalies. In environments that cannot immediately patch, administrators should enforce strict network segmentation to ensure that metadata services and internal APIs are not accessible from the Kubeflow pod network. Additionally configuring ALLOWED_ARTIFACT_DOMAIN_REGEX with a restrictive allowlist of known external domains can limit exposure even if the code flaw persists. Monitoring for unusual outbound HTTP requests originating from pipeline execution pods provides an additional layer of defense against exploitation attempts targeting internal infrastructure resources. This vulnerability aligns with CWE-918 Server-Side Request Forgery and maps to ATT&CK technique T1557 which involves adversary use of credential dumping or lateral movement via cloud metadata services when such access is inadvertently permitted by misconfigured network policies.