CVE-2026-88986 in Pipelines
Summary
by MITRE • 11/05/2026
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment's authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
Kubeflow Pipelines serves as a critical infrastructure component for orchestrating machine learning workflows, allowing data scientists to build, deploy, and manage portable pipelines across various cloud environments. The system relies on a frontend interface that interacts with backend Kubernetes services to monitor pipeline execution status. In versions prior to 2.15.0, the application architecture contains a significant security flaw within its error handling mechanisms for specific API endpoints related to pod monitoring. Specifically, the routes /pipeline/k8s/pod and /pipeline/k8s/pod/events utilize the frontend/server/k8s-helper.ts module to process requests and generate responses when errors occur during these interactions.
The core technical vulnerability lies in how the application handles untrusted input within error messages returned by the backend. When a user accesses one of these endpoints, the system may encounter an error condition that triggers a response containing details about the failure. The flaw manifests because the frontend code incorporates query parameters such as podname and podnamespace directly into HTML-capable error responses without adequate sanitization or encoding. This behavior allows for Cross-Site Scripting, commonly known as XSS, where malicious JavaScript can be injected into the page context if an attacker crafts a specially designed URL containing script payloads within these query values.
This vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation, specifically reflecting stored or reflected input that leads to execution of web-hosted scripts. From an offensive security perspective, this aligns with the MITRE ATT&CK technique T1059.007, indicating Command and Scripting Interpreter via JavaScript in a browser context. The attack vector requires social engineering elements, as it is not fully remote or unauthenticated against the entire system but rather targets users who already possess authentication credentials and route access permissions within the Kubeflow deployment. An attacker must craft a malicious link that directs a victim to an endpoint where an error occurs, causing the injected script to execute in the context of the frontend origin.
The operational impact of this vulnerability is primarily focused on session hijacking and credential theft rather than direct server compromise. Because the JavaScript executes within the frontend's origin domain, it has access to cookies associated with that domain if they are not configured with strict security attributes such as HttpOnly or Secure flags. Consequently, an attacker could potentially steal session tokens or other sensitive cookie data from authenticated users who follow the malicious link and trigger the error condition. However, the vulnerability does not inherently lead to server-side code execution or denial of service conditions on the backend infrastructure, limiting its impact to client-side attacks against specific authorized users.
To mitigate this risk, organizations running Kubeflow Pipelines must upgrade immediately to version 2.15.0 or later, where the issue has been resolved through improved input validation and output encoding practices in the k8s-helper.ts module. In addition to upgrading, administrators should ensure that all cookies used for authentication are configured with the HttpOnly attribute to prevent JavaScript access, as well as the Secure flag to restrict transmission to HTTPS connections only. Implementing a Content Security Policy (CSP) header can also provide an additional layer of defense by restricting the sources from which scripts can be executed, thereby mitigating the impact even if similar vulnerabilities are discovered in future updates.