CVE-2026-88979

A flaw was found in Kubeflow Pipelines. The TensorBoard proxy relies on a publicly known default secret key to sign authentication tokens. In deployments where authorization is disabled, an unauthenticated remote attacker can forge authentication tokens to query internal cluster services on port ...

CVE-2026-88979

Kubeflow Pipelines versions 2.17.0 through 2.18.0 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the TensorBoard proxy. The root cause is the use of a publicly known default MINIO_SECRET_KEY as an HMAC secret for proxy tokens. In authorization-disabled deployments, an ...