{"id":"GHSA-r4mx-2gr2-8277","summary":"Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server","details":"## Summary\n\nKubeflow Pipelines API server does not sufficiently validate SQL identifier fields decoded from the `page_token` pagination parameter. Client-controlled fields can reach SQL query construction, allowing SQL injection through list APIs.\n\nThis advisory consolidates the original pipeline-listing report and the later run-listing report in [GHSA-mhpc-2x8q-2vp9](https://github.com/kubeflow/pipelines/security/advisories/GHSA-mhpc-2x8q-2vp9). Their contributions and chronology are distinguished below.\n\n## Impact and prerequisites\n\nAn attacker able to invoke an affected list API may read data accessible to the API server's database account, including data belonging to other namespaces. The original report demonstrated database read access through an authenticated Kubeflow deployment.\n\nAuthentication and authorization requirements depend on deployment configuration. In multi-user deployments, the attacker must pass the applicable endpoint authorization checks. A single-user deployment that exposes the API without an authentication layer may be reachable without credentials.\n\nThe submitted evidence establishes a confidentiality issue. Database modification was not demonstrated; this advisory does not claim arbitrary database writes.\n\n## Technical details\n\nPagination tokens are base64-encoded JSON, not trusted server-side state. Before the fix, token deserialization accepted structural fields such as key and sort identifiers without sufficient validation before SQL construction.\n\nThe reports describe complementary paths through this defect:\n\n- **Pipeline listing:** the original report demonstrated injection through `KeyFieldName`.\n- **Run listing:** the later report documented `SortByFieldName` reaching query construction in both the v1beta1 and v2beta1 APIs, including metric joins, selected column aliases, ordering, and column propagation through resource-reference and task joins.\n\nThese paths share the unvalidated pagination-token boundary. Review of the later report and its discussion identified no reported path left unresolved by the merged fix.\n\n## Remediation\n\nUpgrade the Kubeflow Pipelines API server to **2.17.0 or later**.\n\n[PR #13127](https://github.com/kubeflow/pipelines/pull/13127), included in 2.17.0, validates token identifiers and filter keys before query construction. It also separates user-facing metric names from SQL identifiers, uses a fixed metric-column alias, and parameterizes the metric-name join condition.\n\nThe PR additionally addresses first-page metric sorting without a pagination token. That additional protection is part of the remediation; the duplicate determination here concerns the page-token claims actually submitted in the two reports, not merely their inclusion in the same PR.\n\nThe original report identified its deployment as **Kubeflow 1.7**, which should not be interpreted as a verified Kubeflow Pipelines component-version boundary. The later report identified **KFP 2.16.0**. These are reported affected environments, not an established introduction version.\n\n## Attribution and report history\n\n- **@phisch1991 and @k0rti:** credited reporters of the original pipeline-listing SQL injection submitted on December 13, 2023.\n- **BugBunny.ai (@bugbunny-research):** submitted the later report on April 1, 2026, documenting the run-listing and metric-query paths in GHSA-mhpc-2x8q-2vp9. This acknowledges that specific contribution without implying authorship of the 2023 report.\n- **Cyber Nagle:** authored the merged remediation in PR #13127.\n\nGHSA-mhpc-2x8q-2vp9 is consolidated here for vulnerability tracking. Its submission and reporter credit remain preserved on that advisory; closure as a duplicate does not characterize the report as invalid.","aliases":["CVE-2026-88985"],"modified":"2026-11-09T23:45:03.837062673Z","published":"2026-11-09T23:25:00Z","database_specific":{"github_reviewed_at":"2026-11-09T23:25:00Z","nvd_published_at":"2026-11-05T22:18:54Z","cwe_ids":["CWE-89"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-r4mx-2gr2-8277"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88985"},{"type":"WEB","url":"https://github.com/kubeflow/pipelines/pull/13127"},{"type":"WEB","url":"https://github.com/kubeflow/pipelines/commit/ac3a4c65677a3bc7a3d5b1e264fba41178d4ab32"},{"type":"PACKAGE","url":"https://github.com/kubeflow/pipelines"},{"type":"WEB","url":"https://github.com/kubeflow/pipelines/releases/tag/2.17.0"}],"affected":[{"package":{"name":"github.com/kubeflow/pipelines","ecosystem":"Go","purl":"pkg:golang/github.com/kubeflow/pipelines"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260403210607-ac3a4c65677a"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r4mx-2gr2-8277/GHSA-r4mx-2gr2-8277.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}