{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-88983","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-09-10T16:02:31.342Z","datePublished":"2026-11-05T21:58:53.008Z","dateUpdated":"2026-11-05T21:58:53.008Z"},"containers":{"cna":{"title":"Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation","problemTypes":[{"descriptions":[{"cweId":"CWE-441","lang":"en","description":"CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-918","lang":"en","description":"CWE-918: Server-Side Request Forgery (SSRF)","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"}}],"references":[{"name":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4","tags":["x_refsource_CONFIRM"],"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-f7vj-6669-qvv4"},{"name":"https://github.com/kubeflow/pipelines/pull/12750","tags":["x_refsource_MISC"],"url":"https://github.com/kubeflow/pipelines/pull/12750"},{"name":"https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3","tags":["x_refsource_MISC"],"url":"https://github.com/kubeflow/pipelines/commit/504d7797c1e061327ddb2bcb8bc1c5dd4940cfc3"},{"name":"https://github.com/kubeflow/pipelines/releases/tag/2.17.0","tags":["x_refsource_MISC"],"url":"https://github.com/kubeflow/pipelines/releases/tag/2.17.0"}],"affected":[{"vendor":"kubeflow","product":"pipelines","versions":[{"version":"< 2.17.0","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-05T21:58:53.008Z"},"descriptions":[{"lang":"en","value":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0."}],"source":{"advisory":"GHSA-f7vj-6669-qvv4","discovery":"UNKNOWN"}}}}