1184 matches found
CVE-2026-54745 Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...
CVE-2026-54745 Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...
PT-2026-83226
Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.17.0 Description The frontend exposes an unauthenticated server-side request forgery SSRF issue. The routePathWithReferer function accepts an arbitrary HTTP or HTTPS target and passes its origin to...
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...
GHSA-F5F4-3HH4-F54M Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...
GO-2026-6223 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines, kubeflow-pipelines-fips...
GO-2026-6223 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: crossplane, kubernetes-csi-external-snapshotter, pulumi-kubernetes-operator, kube-state-metrics, kyverno-notation-aws, kubernetes-csi-external-health-monitor, cluster-autoscaler, keda, kubernetes-csi-external-provisioner, tkn, calico, zot,...
PT-2026-80744
Name of the Vulnerable Software and Affected Versions Tekton Pipelines-as-Code versions prior to 0.48.0 Description When configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by...
PT-2026-80743
Name of the Vulnerable Software and Affected Versions Pipelines-as-Code versions prior to 0.48.0 Description Installations using the GitHub App provider are susceptible to credential exfiltration via the webhook endpoint. The system accepted the X-GitHub-Enterprise-Host request header as the API...
GHSA-48P8-G2FX-3WWM vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines, kubeflow-pipelines-fips...
CVE-2026-73643 vulnerabilities
Vulnerabilities for packages: renovate, authentik-fips, kubeflow-pipelines...
CVE-2026-54526 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines...
CVE-2026-73643 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, renovate...
GHSA-48P8-G2FX-3WWM vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines...
CVE-2026-54526 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-driver-fips, kubeflow-pipelines, kubeflow-pipelines-fips...
GO-2026-5711 vulnerabilities
Vulnerabilities for packages: tkn-fips, tekton-pipelines-fips, tkn, tekton-chains-fips, tekton-chains, tekton-pipelines...