Is CVE-2026-88981 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88981 being exploited in the wild.

How severe is CVE-2026-88981?

High severity, with a CVSS score of 8.6, published 5 November 2026.

Which products and versions are affected?

Kubeflow Pipelines before 2.18.0.

How is CVE-2026-88981 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-88981?

Check whether you run Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88981: Kubeflow Pipelines arbitrary endpoint connection in artifact download

CVE-2026-88981 · Severity: high · CVSS 8.6 · Published 2026-11-05

Kubeflow Pipelines is a machine learning workflow platform that manages data processing and model training at scale. In versions before 2.18.0, an unauthenticated attacker in the default standalone configuration could redirect the shared UI pod to connect to arbitrary storage endpoints and retrieve response data, potentially exposing stored access credentials. This affects deployments without additional authorization controls.

Technologies: Kubeflow Pipelines. Vendors: Kubeflow.

Quick answers

Is CVE-2026-88981 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88981 being exploited in the wild.
How severe is CVE-2026-88981?: High severity, with a CVSS score of 8.6, published 5 November 2026.
Which products and versions are affected?: Kubeflow Pipelines before 2.18.0.
Is there a fix for CVE-2026-88981?: Yes: fixed in 2.18.0. Until then: Require authentication and authorization controls on the Kubeflow Pipelines deployment; do not rely on the shipped authorization-disabled standalone configuration in production environments. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88981 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-88981?: Check whether you run Kubeflow Pipelines at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.18.0

Require authentication and authorization controls on the Kubeflow Pipelines deployment; do not rely on the shipped authorization-disabled standalone configuration in production environments.

Technical details

The vulnerability exists in the frontend artifact download and archived pod-log paths, which accept S3-compatible endpoint metadata from user-supplied providerInfo.Params.endpoint and workflow status without validating that endpoints match operator-controlled storage configuration. An unauthenticated caller can make the ml-pipeline-ui pod connect to arbitrary reachable hosts; requests signed with configured object-store credentials may reveal access-key identifiers. The fix restricts endpoints to operator-configured storage origins and validates metadata, transport, and port before creating storage clients or selecting credentials.

Affected products

Kubeflow Pipelines before 2.18.0

Timeline

2026-11-05: disclosed
2026-09-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.