What is CVE-2026-88986?

CVE-2026-88986 is a medium-severity vulnerability in Kubeflow Pipelines, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-11-05.

How severe is CVE-2026-88986?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Kubeflow Pipelines

CVE-2026-88986

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment's authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2026-11-05 · last modified 2026-11-06.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Kubeflow Pipelines — versions < 2.15.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

Frequently asked questions

What is CVE-2026-88986?: CVE-2026-88986 is a medium-severity vulnerability in Kubeflow Pipelines, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-11-05.
How severe is CVE-2026-88986?: Medium severity. CVSS v3 base score is 6.1 out of 10.