kubeflow vulnerabilities
20 published CVEs name kubeflow among the affected products.
- 20Published CVEs20 of them scored
- 16Last 12 monthspublished in the last year
- 2Critical11 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-88982
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
kubeflow · pipelines
Medium5.4 - CVE-2026-77596
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
kubeflow · pipelines
Critical9.6 - CVE-2026-88981
Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints
kubeflow · pipelines
High8.6 - CVE-2026-88980
Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator
kubeflow · pipelines
High8.6 - CVE-2026-88979
Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy
kubeflow · pipelines
Medium5.8 - CVE-2026-88984
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
kubeflow · pipelines
High7.2 - CVE-2026-88986
Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses
kubeflow · pipelines
Medium6.1 - CVE-2026-88985
Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server
kubeflow · pipelines
Medium6.5 - CVE-2026-88983
Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation
kubeflow · pipelines
Medium5.0 - CVE-2026-118761
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
kubeflow · pipelines
High7.5