KU
Vendor
Kubeflow
7
CVEs
0
On KEV
1
New 30D
Products
MR7.1
Model Registry
Kubeflow
1 CVEs0 on KEV1 new
KU7.5
Kubeflow
Kubeflow
3 CVEs0 on KEV0 new
PI10.0
pipelines
kubeflow
2 CVEs0 on KEV0 new
CO8.0
community-distribution
kubeflow
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110220 | MR Model Registry Kubeflow | 7.1 | Oct 13 | Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation |
| CVE-2026-54745 | PI pipelines kubeflow | 10.0 | Aug 28 | Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true |
| CVE-2026-47237 | CO community-distribution kubeflow | 8.0 | Jul 21 | Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing |
| CVE-2024-9526 | PI Pipelines Kubeflow | 5.4 | Nov 18 | There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines |
| CVE-2024-5552 | KU Kubeflow Kubeflow | 7.5 | Jun 6 | kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism |
| CVE-2023-6571 | KU Kubeflow Kubeflow | 6.1 | Dec 14 | Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow |
| CVE-2023-6570 | KU Kubeflow Kubeflow | 6.5 | Dec 14 | Server-Side Request Forgery (SSRF) in kubeflow/kubeflow |