CVE-2026-54745

A flaw was found in Kubeflow Pipelines. An unauthenticated attacker can exploit a Server-Side Request Forgery SSRF and HTTP smuggling vulnerability through the /proxy/ route. This allows the attacker to bypass authorization and forward arbitrary requests to internal services. Consequently, this c...

GHSA-8423-8FGW-73VQ vulnerabilities

Vulnerabilities for packages: litellm, tensorflow-gpu-jupyter, dask-kubernetes, mitmproxy, kubeflow-pipelines-visualization-server...

GHSA-WWV5-G3V4-889X vulnerabilities

Vulnerabilities for packages: litellm, tensorflow-gpu-jupyter, dask-kubernetes, mitmproxy, kubeflow-pipelines-visualization-server...

CVE-2026-82397 vulnerabilities

Vulnerabilities for packages: litellm, tensorflow-gpu-jupyter, dask-kubernetes, mitmproxy, kubeflow-pipelines-visualization-server...

GHSA-MPF4-983Q-P7J4 vulnerabilities

Vulnerabilities for packages: litellm, tensorflow-gpu-jupyter, dask-kubernetes, mitmproxy, kubeflow-pipelines-visualization-server...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.13-sdk, open-webui, label-studio, apache-beam-python-3.12-sdk, apache-beam-python-3.11-sdk, nemo, py3-nltk, kubeflow-pipelines-visualization-server...

GHSA-MPF4-983Q-P7J4 vulnerabilities

Vulnerabilities for packages: mitmproxy, dask-kubernetes, kubeflow-pipelines-visualization-server...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: py3-nltk, kubeflow-pipelines-visualization-server, open-webui...

CVE-2026-82397 vulnerabilities

Vulnerabilities for packages: mitmproxy, dask-kubernetes, kubeflow-pipelines-visualization-server...

GHSA-8423-8FGW-73VQ vulnerabilities

Vulnerabilities for packages: mitmproxy, dask-kubernetes, kubeflow-pipelines-visualization-server...

GHSA-WWV5-G3V4-889X vulnerabilities

Vulnerabilities for packages: mitmproxy, dask-kubernetes, kubeflow-pipelines-visualization-server...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: py3-nltk, kubeflow-pipelines-visualization-server, open-webui...

GHSA-VP52-PCJ8-J9QC vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-amp, reports-server, kubeflow-pipelines, metrics-server, hubble, falcoctl, gitlab-cng, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-iot-fips, crossplane-provider-aws-eks, external-dns,...

CVE-2026-84304 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-amp, reports-server, kubeflow-pipelines, metrics-server, hubble, falcoctl, gitlab-cng, crossplane-provider-aws-servicediscovery-fips, crossplane-provider-aws-iot-fips, crossplane-provider-aws-eks, external-dns,...

GO-2026-6225 vulnerabilities

Vulnerabilities for packages: crossplane, crossplane-fips, tekton-pipelines, knative-serving-fips, knative-serving, kubeflow-katib, tekton-pipelines-fips...

GO-2026-6225 vulnerabilities

Vulnerabilities for packages: knative-serving, tekton-pipelines, kubeflow-katib, crossplane...

CLEANSTART-2026-IW88811 Security fixes in tekton-pipelines-fips 1.13.1-r1

Package tekton-pipelines-fips version 1.13.1-r1 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-WE59160 Security fixes in tekton-pipelines-fips 1.14.0-r4

Package tekton-pipelines-fips version 1.14.0-r4 fixes 9 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...

CLEANSTART-2026-KH43508 Security fixes in tekton-pipelines-fips 1.13.1-r2

Package tekton-pipelines-fips version 1.13.1-r2 fixes 8 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...

CVE-2026-54745

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...