Skip to content
OpenAdvisories

Package · Go

github.com/kubeflow/pipelines

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.2
    CVE-2026-88984

    Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines

    Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and del…

    kubeflow pipelines github.com/kubeflow/pipelines Go
  • High 7.5
    CVE-2026-118761

    Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

    Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. …

    kubeflow pipelines github.com/kubeflow/pipelines Go
  • High 7.5
    CVE-2026-118759

    Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant

    Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the select…

    kubeflow pipelines github.com/kubeflow/pipelines Go
  • High 7.1
    CVE-2024-9526

    Stored XSS in Kubeflow Pipeline View

    There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered pro…

    kubeflow Kubeflow Pipeline View github.com/kubeflow/pipelines Go