Kubeflow Pipelines API server versions before 0.0.0-20260403210607-ac3a4c65677a contain a SQL injection vulnerability via unvalidated SQL identifier fields decoded from the page_token pagination parameter. This allows an authenticated attacker with access to list APIs to read database data accessible to the API server, potentially including data from other namespaces. The vulnerability affects pipeline-listing and run-listing APIs. A fix is available in version 0.0.0-20260403210607-ac3a4c65677a and later.