Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M
CVE-2026-77596Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
Critical 9.6
In plain English
A critical-severity authorization bypass via user-controlled key in pipelines from kubeflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant's namespace under that workload's service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0.
Affected products (as reported)
Weakness: CWE-639, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References
- https://github.com/kubeflow/pipelines/security/advisories/GHSA-rjr3-43j3-4q8g x_refsource_CONFIRM
- https://github.com/kubeflow/pipelines/pull/14352 x_refsource_MISC
- https://github.com/kubeflow/pipelines/commit/62516d8c525f146b754cb515cf441dd0290ad841 x_refsource_MISC
- https://github.com/kubeflow/pipelines/releases/tag/2.18.0 x_refsource_MISC