Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses

Summary

The Kubeflow Pipelines frontend reflected untrusted pod names and namespaces into HTML error responses from the pod-information and pod-events routes. An attacker could craft a link that causes JavaScript to execute in the frontend's origin when a user follows it and reaches an affected error response.

Affected routes include /pipeline/k8s/pod and /pipeline/k8s/pod/events (the deployment's configured base path may differ).

Impact and prerequisites

Successful exploitation requires a victim to open an attacker-supplied link and reach the vulnerable response. JavaScript execution may expose information accessible to the victim's browser or perform actions in the application's origin.

The attacker does not need an account merely to construct and deliver the link. The victim must satisfy the deployment's authentication and route-access requirements. Cookie theft depends on cookie attributes and deployment protections; it is not guaranteed. The submitted evidence does not establish an availability impact or server-side code execution.

Technical details

The pod handlers pass podname and podnamespace query values to getPod and listPodEvents in frontend/server/k8s-helper.ts. Before remediation, failure messages incorporated those values, along with backend error details, and were returned as HTML-capable string responses.

Kubernetes rejecting an invalid resource name did not prevent the issue: the rejected name could still be included in the frontend's error response.

PR #12295 changed the error construction to validate pod names and namespaces with isAllowedResourceName. Invalid values produce a constant error message instead of reflecting the supplied value, and backend error details are no longer included in these responses. The change includes invalid-resource-name tests.

Affected versions and remediation

Affected product: the Kubeflow Pipelines frontend server, identified as ghcr.io/kubeflow/kfp-frontend. Historical releases may use earlier image registry names.

Upgrade to KFP 2.15.0 or later.

The fix merged on October 10, 2025, in commit fedc25e3f7251933d4a37b964bc3e8176beea28e. It is first present in the 2.15.0 release, published November 25, 2025.

The affected range is recorded as < 2.15.0. The original introduction version and separate maintenance-branch backports have not been established. These are KFP component versions, not Kubeflow platform or Python SDK versions.

Distinction from existing artifact XSS

CVE-2023-6571, tracked in the repository as GHSA-j9xw-rrjg-2p9r, documents reflection of the artifact source parameter in an unknown-storage-source error.

This report concerns different handlers and error construction: pod information and pod events. The artifact-source fix in PR #9844, released in 2.0.2, did not repair these pod responses. They required the later change in #12295.

This independently fixable pod-route defect is tracked as CVE-2026-88986. It does not broaden CVE-2023-6571 or absorb artifact-content rendering and other XSS reports.

Attribution

@pwny0 submitted this report on September 23, 2023, and retains the reporter credit.

@JerT33 authored the remediation in PR #12295. Fix attribution is separate from vulnerability-report attribution.