github.com/kubeflow/pipelines
Go9 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/kubeflow/pipelinespage 1 of 1
- CVE-2024-9526MEDIUMCVSS 5.4EG 5.42024-11-18
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which…
- CVE-2026-118759HIGHCVSS 7.5EG 7.5fixed in 0.0.0-20260904182349-be4723e337272026-10-29
vulnerable: 1.7.0-alpha.3
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the calle…
- CVE-2026-118761HIGHCVSS 7.5EG 7.5fixed in 0.0.0-20260831164314-ba9ae72cc8602026-10-29
vulnerable: 1.7.0-alpha.3
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading…
- CVE-2026-77596CRITICALCVSS 9.6EG 9.6fixed in 0.0.0-20260909234119-62516d8c525f2026-11-05
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call can…
- CVE-2026-88982MEDIUMCVSS 5.4EG 5.4fixed in 0.0.0-20260910172610-620d0cc89ae02026-11-05
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields withou…
- CVE-2026-88983MEDIUMCVSS 5.0EG 5.0fixed in 0.0.0-20260517162502-504d7797c1e02026-11-05
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the …
- CVE-2026-88984HIGHCVSS 7.2EG 7.2fixed in 0.0.0-20260420170029-186dd1f3b0402026-11-05
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for …
- CVE-2026-88985MEDIUMCVSS 6.5EG 6.5fixed in 0.0.0-20260403210607-ac3a4c65677a2026-11-05
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before co…
- CVE-2026-88986MEDIUMCVSS 6.1EG 6.1fixed in 0.0.0-20251010122814-fedc25e3f7252026-11-05
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted …
Check whether github.com/kubeflow/pipelines is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/kubeflow/pipelines CVEs against the assets you own.
Book a Demo →