CVE-2026-88986: Reflected Cross-Site Scripting in Kubeflow Pipelines Frontend Error Responses

Vulnerability ID: CVE-2026-88986
CVSS Score: 6.1
Published: 2026-11-09

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Kubeflow Pipelines frontend server prior to version 2.15.0. Specifically, the Express route handlers for '/pipeline/k8s/pod' and '/pipeline/k8s/pod/events' reflect unvalidated 'podname' and 'podnamespace' query parameters, along with backend Kubernetes API error messages, directly into HTML-capable HTTP error responses. An unauthenticated attacker can exploit this flaw by convincing an authenticated user to visit a crafted URL, resulting in arbitrary JavaScript execution within the context of the Kubeflow Pipelines frontend origin.

TL;DR

Kubeflow Pipelines versions prior to 2.15.0 are vulnerable to reflected XSS (CVE-2026-88986) in the '/pipeline/k8s/pod' and '/pipeline/k8s/pod/events' endpoints due to unescaped query parameters in error responses. Upgrading to version 2.15.0 resolves this issue by enforcing strict DNS-1123 naming validation and suppressing raw backend errors.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Type: CWE-79: Cross-Site Scripting (Reflected)
• Affected Component: frontend/server/k8s-helper.ts (/pipeline/k8s/pod & /pipeline/k8s/pod/events)
• Attack Vector: Network (Crafted URL via HTTP GET parameters podname and podnamespace)
• CVSS v3.1 Score: 6.1 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
• EPSS Score: 0.28% (20.17th Percentile)
• Impact: Arbitrary JavaScript execution in the victim's browser under the frontend origin
• Exploit Status: PoC in unit tests (No known active exploitation)
• Patched Version: Kubeflow Pipelines 2.15.0

Affected Systems

• Kubeflow Pipelines (kubeflow/pipelines)
• Kubeflow Pipelines: < 2.15.0 (Fixed in: 2.15.0)

Code Analysis

Commit: fedc25e

Validate Kubernetes resource names using isAllowedResourceName and suppress verbose error reflection in frontend and backend handlers (PR #12295).

export function isAllowedResourceName(name: string): boolean {
  return name.length > 0 && name.length <= 63 && /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/.test(name);
}

export async function getPod(
  podName: string,
  podNamespace: string,
): Promise<[V1Pod | undefined, K8sError | undefined]> {
  try {
    const { body } = await k8sV1Client.readNamespacedPod(podName, podNamespace);
    return [body, undefined];
  } catch (error) {
    let userMessage = `Could not get pod ${podName} in namespace ${podNamespace}`;
    if (!isAllowedResourceName(podName) || !isAllowedResourceName(podNamespace)) {
      userMessage = `Invalid resource name`;
    }
    return [undefined, { message: userMessage }];
  }
}

Mitigation Strategies

• Upgrade Kubeflow Pipelines to version 2.15.0 or later to enforce strict DNS-1123 input validation and suppress raw backend error reflection.
• Deploy Web Application Firewall (WAF) or Ingress filtering rules to restrict 'podname' and 'podnamespace' query parameters to lowercase alphanumeric characters and hyphens.
• Configure HTTP security headers at the ingress layer, specifically Content-Security-Policy (CSP) disallowing inline scripts and X-Content-Type-Options: nosniff.
• Ensure session cookies used by the authentication layer have the HttpOnly and SameSite attributes enabled to limit session token theft.

Remediation Steps:

1. Identify the currently deployed Kubeflow Pipelines version across all clusters.
2. Update the Kubeflow Pipelines manifests or Helm charts to reference release version 2.15.0 (or later).
3. Roll out the updated deployment for the 'ml-pipeline-ui' (kfp-frontend) and 'ml-pipeline' (apiserver) workloads.
4. Verify the remediation by sending a test request with invalid characters in 'podnamespace' to '/pipeline/k8s/pod' and confirming the response returns the static string 'Invalid resource name'.

References

• GitHub Security Advisory: GHSA-g3qx-frcg-j979
• GitHub Pull Request #12295: Fix XSS and error reflection in Kubeflow Pipelines
• GitHub Commit fedc25e3f7251933d4a37b964bc3e8176beea28e
• Kubeflow Pipelines Release 2.15.0
• National Vulnerability Database (NVD): CVE-2026-88986
• CVE.org Record: CVE-2026-88986
• CVEListV5 JSON Record: CVE-2026-88986

Read the full report for CVE-2026-88986 on our website for more details including interactive diagrams and full exploit analysis.