Description

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnamespace query values and backend error details in HTML-capable error responses. An unauthenticated attacker can craft a link that executes JavaScript in the frontend origin when a user who satisfies the deployment's authentication and route-access requirements follows it and reaches an affected response. Cookie disclosure depends on cookie attributes, and server-side code execution or availability impact is not established. This issue is fixed in version 2.15.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-11-05T22:18:54.743Z",
  "pubdate": "2026-11-05T22:18:54.743Z",
  "executiveSummary": "Kubeflow Pipelines versions prior to 2.15.0 are susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability residing within the frontend routing logic.\nThe vulnerability arises from the improper sanitization of user-supplied query parameters, specifically 'podname' and 'podnamespace', which are subsequently reflected into HTML-capable error responses generated by the 'frontend/server/k8s-helper.ts' component.\nAn unauthenticated attacker can craft a malicious URL containing arbitrary JavaScript payloads. When a user who meets the deployment's authentication and route-access criteria clicks this link, the malicious script executes within the context of the Kubeflow frontend origin.\nThe primary risk involves the compromise of the user's session within the application. Depending on the cookie security attributes, this may lead to session hijacking or sensitive data exfiltration.\nWhile server-side code execution or direct impact on system availability is not established, the vulnerability poses a significant risk to user integrity and data confidentiality by allowing attackers to perform actions on behalf of the victim or observe user interactions with the Kubeflow interface.",
  "technicalDetails": "The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw located in the frontend request handling mechanism of Kubeflow Pipelines. The root cause is the inadequate validation and encoding of inputs sourced from HTTP query parameters.\nSpecifically, the frontend routes '/pipeline/k8s/pod' and '/pipeline/k8s/pod/events' delegate request processing to the 'frontend/server/k8s-helper.ts' utility. This module consumes 'podname' and 'podnamespace' values directly from the request URI and incorporates them, alongside detailed backend error messages, into the HTML response body returned to the client browser.\nExploitation is achieved when an attacker constructs a URL that injects malicious JavaScript into these query parameters. Because the application fails to perform context-aware output encoding or sanitization before rendering the error page, the browser interprets the injected strings as executable scripts.\nThe attack flow follows a structured path: First, the attacker identifies a target installation of an affected Kubeflow version. Second, they craft a URL that includes a script payload within the 'podname' or 'podnamespace' parameters. Third, the attacker lures an authenticated user (such as an administrator or data scientist) to click this crafted link.\nUpon accessing the link, the user's browser sends the request to the Kubeflow frontend. The server-side code in 'frontend/server/k8s-helper.ts' fails to sanitize the inputs, resulting in a server response containing the attacker's payload. The user's browser, receiving the malformed HTML, renders the document and executes the injected JavaScript code within the security context of the Kubeflow domain.\nThe impact is significant, as the malicious script runs with the privileges of the victim's authenticated session. This allows for the theft of cookies (if not protected by HttpOnly flags), unauthorized interaction with the Kubeflow API, or the exfiltration of sensitive machine learning workflow data visible to the victim. The requirement that the victim must satisfy authentication and route-access criteria acts as a barrier, but does not mitigate the risk to authorized users, who are the primary targets for such client-side attacks."
}