← CVE Radar
CVE-2026-88985Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0.
6.5 MEDIUMEPSS 0.26%Not in KEVNVD: Awaiting Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 6.5 | MEDIUM | 3.1GitHub_M (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Details
- CVE ID
- CVE-2026-88985
- Status
- Awaiting Analysis
- Assigner (CNA)
- GitHub_M
- Published
- Nov 5, 2026
- Last modified
- 2026-11-06 21:40 UTC
- Weaknesses
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
As published by the CNA in the CVE record.
kubeflowpipelines1 version range
- < 2.17.0
References
- github.com https://github.com/kubeflow/pipelines/commit/ac3a4c65677a3bc7a3d5b1e264fba41178d4ab32
- github.com https://github.com/kubeflow/pipelines/pull/13127
- github.com https://github.com/kubeflow/pipelines/releases/tag/2.17.0
- github.com https://github.com/kubeflow/pipelines/security/advisories/GHSA-r4mx-2gr2-8277