TI-2026-39556 CVE-2026-54745
Improper access control in kubeflow pipelines
Priority HIGH 82
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
kubeflow
Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
kubeflow records in CISA KEVNo kubeflow vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
20 records
TI-2024-05160 CVE-2024-5552 · GHSA-qjvx-7f9v-7wfv
ReDoS in kubeflow/kubeflow
Priority HIGH 72
kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism.
TI-2026-34822 CVE-2026-47237
Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing
Priority HIGH 70
Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters.
Priority HIGH 65
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
TI-2026-73437 CVE-2026-110220 · GHSA-q9m2-3393-574q
Server-side request forgery in Kubeflow Model Registry leaks tokens
Priority MEDIUM 64
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation.
Priority MEDIUM 43
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
TI-2026-85695 CVE-2026-77596
Kubeflow Pipelines API server skips authorization for shared pipeline uploads
Priority MEDIUM 41
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
TI-2026-82675 CVE-2026-118761 · GHSA-8fmv-6rg5-5924
Decompression bomb in Kubeflow Pipelines exhausts API server memory
Priority LOW 39
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
TI-2026-82673 CVE-2026-118759 · GHSA-wg5q-x4j9-qm54
Missing authorization in Kubeflow Pipelines exposes run pod logs
Priority LOW 39
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
Priority LOW 39
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
Priority LOW 38
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
TI-2024-08837 CVE-2024-9526 · GHSA-rm25-8wjq-c6qm
Stored XSS in Kubeflow Pipeline View
Priority LOW 33
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI.
Priority LOW 31
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
TI-2023-06021 CVE-2023-6570 · GHSA-3mj9-8h4m-j8f7
Server-Side Request Forgery (SSRF) in kubeflow/kubeflow
Priority LOW 30
Server-Side Request Forgery (SSRF) in kubeflow/kubeflow
Priority LOW 29
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
Priority LOW 28
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
TI-2023-06022 CVE-2023-6571 · GHSA-7rvc-xw75-43jf
Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow
Priority LOW 28
Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow
Priority LOW 27
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
Priority LOW 23
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.
Priority LOW 22
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.