CVE-2026-77596 · Package
NO FIX YET · SEE WHAT TO DO
Kubeflow Pipelines skips its write-permission check on pipeline upload when no namespace is given, which is the default. A low-privilege tenant, or an unauthenticated caller if the API server is reachable without an authenticating proxy, can create shared pipelines or inject versions that later run under another tenant's service account.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Multi-user Kubeflow Pipelines deployments before 2.18.0 that run with the default REQUIRE_NAMESPACE_FOR_PIPELINES setting are exposed. Deployments where the API server sits behind an authenticating proxy do not allow anonymous access, but a low-privilege tenant can still exploit the bypass. Single-user deployments and those that set the namespace requirement are less exposed.
Not affected if auth-required, default-config
Who cares kubeflow, kubernetes, machine-learning, multi-tenant
2.18.0.REQUIRE_NAMESPACE_FOR_PIPELINES is set to true; it defaults to false.2.18.0.Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns without SubjectAccessReview when the target namespace is empty while REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission; if the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass, while deployments protected by such a proxy do not expose anonymous access. An enabled unpinned recurring run that follows the latest version can then execute the injected specification in another tenant's namespace under that workload's service account, while pinned or embedded-specification runs are not automatically substituted. This issue is fixed in version 2.18.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.