Information Exposure Affecting kubeflow-katib package, versions <0.19.0-r40
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-WOLFILATEST-KUBEFLOWKATIB-19827669
- published15 Sept 2026
- disclosed10 Sept 2026
Introduced: 10 Sep 2026
NewCVE-2026-88059 (opens in a new tab)How to fix?
Upgrade Wolfi kubeflow-katib to version 0.19.0-r40 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kubeflow-katib package and not the kubeflow-katib package as distributed by Wolfi.
See How to fix? for Wolfi relevant fixed versions and status.
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. Exploitation requires provideClientHydration, child provideHttpClient delegation through withRequestsMadeViaParent, parent-level credential injection, and an SSR HTML response shared across users by a CDN, reverse proxy, or application cache. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data. Applications can mitigate by attaching credentials at the child, filtering sensitive endpoints with withHttpTransferCacheOptions, disabling transfer caching for sensitive routes, or marking personalized HTML private or no-store. This issue is fixed in versions 20.3.28, 21.2.20, and 22.1.1.
References
- https://github.com/angular/angular/commit/c45028e44f5f3c1e0006eaccf86642deca51b2af
- https://github.com/angular/angular/commit/caf616670fd20d528aa69e0131cc17d60f0cc27d
- https://github.com/angular/angular/commit/e4c416c20a1cb222ce73d29c035452b257380c56
- https://github.com/angular/angular/issues/69777
- https://github.com/angular/angular/pull/69778
- https://github.com/angular/angular/releases/tag/v20.3.28
- https://github.com/angular/angular/releases/tag/v21.2.20
- https://github.com/angular/angular/releases/tag/v22.1.1
- https://github.com/angular/angular/security/advisories/GHSA-p297-fm68-3q8c