CVE-2026-88986

Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.15.0

Description The frontend routes '/pipeline/k8s/pod' and '/pipeline/k8s/pod/events' utilize the frontend/server/k8s-helper.ts file to include untrusted podname and podnamespace query values, along with backend error details, in HTML-capable error responses. This allows an unauthenticated attacker to craft a link that executes JavaScript in the frontend origin when accessed by a user who meets the authentication and route-access requirements. Cookie disclosure may occur depending on cookie attributes.

Recommendations Update to version 2.15.0.