Kubeflow pipelines

• CVE-2026-88982 Medium 5.4 Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) 0.1%
• CVE-2026-77596 Critical 9.6 Kubeflow Pipelines API server lacks authorization for shared pipeline uploads 0.2%
• CVE-2026-88981 High 8.6 Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints 0.3%
• CVE-2026-88980 High 8.6 Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator 0.6%
• CVE-2026-88979 Medium 5.8 Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy 0.2%
• CVE-2026-88984 High 7.2 Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines 0.3%
• CVE-2026-88986 Medium 6.1 Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses 0.3%
• CVE-2026-88985 Medium 6.5 Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server 0.3%
• CVE-2026-88983 Medium 5.0 Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation 0.2%
• CVE-2026-118761 High 7.5 Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory 0.5%
• CVE-2026-118760 Medium 6.5 Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads 0.4%
• CVE-2026-118759 High 7.5 Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant 0.3%
• CVE-2026-118758 High 7.5 Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source 0.5%
• CVE-2026-54745 Critical 10.0 Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true 0.6%