CVE-2026-88980

Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.18.0

Description The frontend GET '/artifacts/get' route allows the use of source=http or source=https with caller-controlled bucket and key values. The isAllowedResourceName function permits all-digit decimal hosts, which the URL parser converts to IPv4 addresses. In standalone configurations where authorization is disabled, unauthenticated callers can fetch internal HTTP resources. In authenticated multi-user configurations, low-privilege tenants with a valid identity and authorized namespace can exploit this destination-validation defect. This can lead to the disclosure of cloud credentials if metadata services are reachable and roles are attached, although it does not bypass IMDSv2 (Instance Metadata Service version 2) when metadata is blocked.

Recommendations Update to version 2.18.0.