CVE-2026-88985 in Pipelines
Summary
by MITRE • 11/06/2026
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/06/2026
Kubeflow Pipelines serves as a critical infrastructure component for orchestrating machine learning workflows, allowing organizations to build, deploy, and manage scalable ML systems. The security integrity of this platform relies heavily on the robustness of its API server, which handles sensitive operations such as listing pipeline runs and managing workflow states. In versions prior to 2.17.0, a significant architectural flaw existed within how the API server processed pagination parameters for list queries. Specifically, the system accepted base64-encoded JSON payloads in the page_token parameter and proceeded to decode them without sufficient validation of the structural SQL identifier fields contained therein. This design decision created an opportunity for attackers to manipulate database query structures by injecting malicious content into specific field names used for sorting or key identification.
The technical core of this vulnerability lies in improper neutralization of special elements used in a command, commonly categorized under CWE-77: Injection. When the API server constructs SQL queries based on fields like KeyFieldName and SortByFieldName derived from the decoded page_token, it fails to sanitize these inputs against injection patterns. An attacker who possesses the ability to invoke an affected pipeline or trigger a run list API call can craft a maliciously encoded JSON payload. By injecting arbitrary SQL syntax into these field name parameters, the attacker effectively alters the structure of the underlying database query. This capability extends across various metric paths for listing runs in both v1beta1 and v2beta1 APIs, indicating that the flaw is pervasive within the versioned API endpoints responsible for retrieving workflow execution data.
The operational impact of this vulnerability is severe due to its potential for unauthorized data access. Because the injected SQL commands are executed with the privileges of the database account configured for the Kubeflow Pipelines server, an attacker can potentially read sensitive information stored in the backend database across all namespaces accessible by that service account. This includes details about other users' machine learning workflows, hyperparameters, model artifacts references, and execution logs. While the vulnerability does not currently allow for direct modification of the database content, such as inserting or deleting records, the ability to exfiltrate data represents a critical breach of confidentiality. In environments where multiple teams share a Kubeflow instance, this flaw could lead to significant intellectual property theft or exposure of proprietary ML models and training strategies.
To mitigate this risk, organizations running affected versions must upgrade immediately to version 2.17.0 or later, which implements proper validation and sanitization for SQL identifier fields before they are used in query construction. For environments where an immediate upgrade is not feasible due to operational constraints, network-level controls should be implemented to restrict access to the Kubeflow Pipelines API server endpoints to only authorized service accounts and users with legitimate business needs. Additionally, implementing strict input validation at a reverse proxy or ingress controller level can provide an additional layer of defense by blocking requests containing suspicious patterns in query parameters before they reach the application logic. Monitoring database logs for anomalous SQL syntax errors or unusual query structures may also help detect exploitation attempts in real-time.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059: Command and Scripting Interpreter if an attacker were to leverage the injection further, though currently it is primarily associated with data exfiltration techniques such as T1005: Data from Local System or T1213: Data from Information Repositories. The lack of database modification capability limits the scope to information disclosure rather than full system compromise, but given the sensitivity of ML datasets and models, this remains a high-severity issue that requires prompt remediation through patching and access control hardening.