Security
فارسی
All products

github.com/kubeflow/pipelines

Go · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responsesCVE-2026-88986 · GHSA-G3QX-FRCG-J979 github.com/kubeflow/pipelines Go Medium Fix reported
Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API serverCVE-2026-88985 · GHSA-R4MX-2GR2-8277 github.com/kubeflow/pipelines Go Medium Fix reported
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelinesCVE-2026-88984 · GHSA-GHGH-57QV-H687 github.com/kubeflow/pipelines Go High Fix reported
Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validationCVE-2026-88983 · GHSA-F7VJ-6669-QVV4 github.com/kubeflow/pipelines Go Medium Fix reported
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)CVE-2026-88982 · GHSA-2XWH-426Q-42C5 github.com/kubeflow/pipelines Go Medium Fix reported
Kubeflow Pipelines API server lacks authorization for shared pipeline uploadsCVE-2026-77596 · GHSA-RJR3-43J3-4Q8G github.com/kubeflow/pipelines Go Critical Fix reported
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logsCVE-2026-118759 · GHSA-WG5Q-X4J9-QM54Version ranges need review. github.com/kubeflow/pipelinesRed Hat OpenShift AI (RHOAI)/rhoai/odh-ml-pipelines-api-server-v2-rhel9 GoRed Hat High Fix reported
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memoryCVE-2026-118761 · GHSA-8FMV-6RG5-5924Version ranges need review. github.com/kubeflow/pipelinesRed Hat OpenShift AI (RHOAI)/rhoai/odh-ml-pipelines-api-server-v2-rhel9 GoRed Hat High Fix reported
Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelinesCVE-2024-9526 · GO-2024-3278 github.com/kubeflow/pipelines Go Unknown No fix reported