GHSA-r4mx-2gr2-8277

Summary

Kubeflow Pipelines API server does not sufficiently validate SQL identifier fields decoded from the page_token pagination parameter. Client-controlled fields can reach SQL query construction, allowing SQL injection through list APIs.

This advisory consolidates the original pipeline-listing report and the later run-listing report in GHSA-mhpc-2x8q-2vp9. Their contributions and chronology are distinguished below.

Impact and prerequisites

An attacker able to invoke an affected list API may read data accessible to the API server's database account, including data belonging to other namespaces. The original report demonstrated database read access through an authenticated Kubeflow deployment.

Authentication and authorization requirements depend on deployment configuration. In multi-user deployments, the attacker must pass the applicable endpoint authorization checks. A single-user deployment that exposes the API without an authentication layer may be reachable without credentials.

The submitted evidence establishes a confidentiality issue. Database modification was not demonstrated; this advisory does not claim arbitrary database writes.

Technical details

Pagination tokens are base64-encoded JSON, not trusted server-side state. Before the fix, token deserialization accepted structural fields such as key and sort identifiers without sufficient validation before SQL construction.

The reports describe complementary paths through this defect:

• Pipeline listing: the original report demonstrated injection through KeyFieldName.
• Run listing: the later report documented SortByFieldName reaching query construction in both the v1beta1 and v2beta1 APIs, including metric joins, selected column aliases, ordering, and column propagation through resource-reference and task joins.

These paths share the unvalidated pagination-token boundary. Review of the later report and its discussion identified no reported path left unresolved by the merged fix.

Remediation

Upgrade the Kubeflow Pipelines API server to 2.17.0 or later.

PR #13127, included in 2.17.0, validates token identifiers and filter keys before query construction. It also separates user-facing metric names from SQL identifiers, uses a fixed metric-column alias, and parameterizes the metric-name join condition.

The PR additionally addresses first-page metric sorting without a pagination token. That additional protection is part of the remediation; the duplicate determination here concerns the page-token claims actually submitted in the two reports, not merely their inclusion in the same PR.

The original report identified its deployment as Kubeflow 1.7, which should not be interpreted as a verified Kubeflow Pipelines component-version boundary. The later report identified KFP 2.16.0. These are reported affected environments, not an established introduction version.

Attribution and report history

• @phisch1991 and @k0rti: credited reporters of the original pipeline-listing SQL injection submitted on December 13, 2023.
• BugBunny.ai (@bugbunny-research): submitted the later report on April 1, 2026, documenting the run-listing and metric-query paths in GHSA-mhpc-2x8q-2vp9. This acknowledges that specific contribution without implying authorship of the 2023 report.
• Cyber Nagle: authored the merged remediation in PR #13127.

GHSA-mhpc-2x8q-2vp9 is consolidated here for vulnerability tracking. Its submission and reporter credit remain preserved on that advisory; closure as a duplicate does not characterize the report as invalid.