CVE-2026-88985: SQL Injection via Pagination Token Deserialization and Metric Sorting in Kubeflow Pipelines API Server

Vulnerability ID: CVE-2026-88985
CVSS Score: 6.5
Published: 2026-11-09

CVE-2026-88985 is a SQL injection vulnerability (CWE-89) in the Kubeflow Pipelines (KFP) API server prior to version 2.17.0. The flaw stems from the untrusted deserialization of base64-encoded JSON pagination tokens (page_token) and the direct concatenation of metric names during run list sorting. Authenticated users with permissions to invoke REST or gRPC list endpoints can inject arbitrary SQL syntax into structural query identifiers and JOIN predicates, enabling unauthorized cross-tenant read access to all database records accessible by the API server.

TL;DR

Kubeflow Pipelines prior to 2.17.0 fails to validate SQL identifier fields inside base64-encoded pagination tokens and concatenates metric sorting names directly into SQL queries, allowing authenticated users to execute arbitrary SQL read queries across all tenant namespaces.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-88985 (GHSA-r4mx-2gr2-8277)
• Vulnerability Class: CWE-89: SQL Injection
• CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
• EPSS Score: 0.26% (17.79th Percentile)
• Attack Vector: Network (Authenticated REST/gRPC List Endpoints)
• Security Impact: Unauthorized cross-tenant database read access
• Exploit Status: Proof-of-Concept / Unit Regression Tests
• Patched Version: Kubeflow Pipelines 2.17.0

Affected Systems

• Kubeflow Pipelines (kubeflow/pipelines) < 2.17.0
• Kubeflow Pipelines: < 2.17.0 (Fixed in: 2.17.0)

Code Analysis

Commit: ac3a4c6

Validate SQL identifiers in pagination tokens and parameterize metric sorting in run store (PR #13127)

Mitigation Strategies

• Upgrade Kubeflow Pipelines to version 2.17.0 or later to enforce strict regex allowlisting on deserialized token identifiers and parameterize metric sort queries.
• Deploy Web Application Firewall (WAF) or Istio EnvoyFilter rules to inspect base64-decoded page_token payloads and sort_by query parameters for SQL syntax.
• Ensure the database connection string used by the KFP API server does not enable multi-statement execution (keep multiStatements=false).

Remediation Steps:

1. Identify all deployed instances of Kubeflow Pipelines (ml-pipeline deployment) running versions prior to 2.17.0.
2. Update the Kubeflow Pipelines manifests or Helm charts to reference release version 2.17.0 (or later).
3. Apply the updated manifests to the Kubernetes cluster and verify that the ml-pipeline API server pod restarts with the patched image.
4. Audit API server access logs and database query logs for anomalous page_token or sort_by=metric: requests containing SQL characters.

References

• GitHub Security Advisory GHSA-r4mx-2gr2-8277
• Kubeflow Pipelines Fix Pull Request #13127
• Official Fix Commit ac3a4c65677a3bc7a3d5b1e264fba41178d4ab32
• Kubeflow Pipelines Release 2.17.0
• CVE.org Record: CVE-2026-88985
• NVD Vulnerability Detail: CVE-2026-88985
• CVEListV5 JSON Record: CVE-2026-88985

Read the full report for CVE-2026-88985 on our website for more details including interactive diagrams and full exploit analysis.