CVE-2026-88986

Prior to version 2.15.0 , Kubeflow Pipelines is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw (CWE-79). The issue exists in the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events, where the frontend/server/k8s-helper.ts component includes untrusted podname and podnamespace...