PI
Product
pipelines
6
CVEs
0
On KEV
10.0
Max CVSS
4
New 30D
Severity mix
Critical 1High 3Medium 2Low 0
Watch
Add pipelines to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-54745 | 10.0 | Aug 28 | Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true Affected: < 2.17.0 |
| CVE-2026-118761 New | 7.5 | Oct 29 | Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory Affected: < 2.18.0 |
| CVE-2026-118759 New | 7.5 | Oct 29 | Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant Affected: < 2.18.0 |
| CVE-2026-118758 New | 7.5 | Oct 29 | Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source Affected: < 2.18.0 |
| CVE-2026-118760 New | 6.5 | Oct 29 | Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads Affected: < 2.17.0 |
| CVE-2024-9526 | 5.4 | Nov 18 | Stored XSS in Kubeflow Pipeline View Affected: before 2023-12-13 |
Showing 6